theory Finalise_C

lemma pageTableMapped_ccorres:
  "ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_'
           (invs' and K (asid \<le> mask asid_bits))
           (UNIV \<inter> {s. asid_' s = asid} \<inter> {s. vaddr_' s = vaddr} \<inter> {s. pt_' s = Ptr ptPtr}) []
      (pageTableMapped asid vaddr ptPtr) (Call pageTableMapped_'proc)" apply (cinit lift: asid_' vaddr_' pt_') apply (simp add: ignoreFailure_def catch_def
                    bindE_bind_linearise liftE_def
               del: Collect_const cong: call_ignore_cong) apply (rule ccorres_split_nothrow_novcg_case_sum) apply clarsimp apply (ctac (no_vcg) add: findPDForASID_ccorres) apply ceqv apply (simp add: Collect_False del: Collect_const cong: call_ignore_cong) apply csymbr apply (rule_tac xf'=pde_' and r'=cpde_relation in ccorres_split_nothrow_novcg) apply (rule ccorres_add_return2, rule ccorres_pre_getObject_pde) apply (rule ccorres_move_array_assertion_pd
             | (rule ccorres_flip_Guard, rule ccorres_move_array_assertion_pd))+ apply (rule_tac P="ko_at' x (lookup_pd_slot rv vaddr) and no_0_obj'
                            and page_directory_at' rv"
                         in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def lookup_pd_slot_def Let_def) apply (drule(1) page_directory_at_rf_sr) apply (erule cmap_relationE1[OF rf_sr_cpde_relation],
                  erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps' shiftl_t2n field_simps) apply ceqv apply (rule_tac P="rv \<noteq> 0" in ccorres_gen_asm) apply csymbr+ apply (wpc, simp_all add: returnOk_bind throwError_bind
                              del: Collect_const) prefer 2 apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cpde_relation_def Let_def return_def addrFromPPtr_def
                                  pde_pde_coarse_lift_def) apply (fastforce simp: Let_def pde_lift_def addrFromPPtr_def ptrFromPAddr_def
                                   option_to_ptr_def
                            split: if_splits) apply ((rule ccorres_cond_false_seq ccorres_cond_false
                          ccorres_return_C | simp)+)[3] apply (simp only: simp_thms) apply wp apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (simp add: cpde_relation_def Let_def pde_lift_def
                 split: if_split_asm,
              auto simp: option_to_0_def option_to_ptr_def pde_tag_defs)[1] apply simp apply (rule ccorres_split_throws) apply (rule ccorres_return_C, simp+) apply vcg apply (wp hoare_drop_imps findPDForASID_nonzero) apply (simp add: guard_is_UNIV_def word_sle_def pdBits_def pageBits_def
                     unat_gt_0 unat_shiftr_le_bound pdeBits_def) apply (simp add: guard_is_UNIV_def option_to_0_def option_to_ptr_def) apply auto[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (invs' and K (asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr ptPtr\<rbrace>) [] (pageTableMapped asid vaddr ptPtr) (Call pageTableMapped_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1430 pt vaddra asida) (?Q'1430 pt vaddra asida) [SKIP] (doE pd <- findPDForASID asid;
liftE (getObject (lookup_pd_slot pd vaddr)) >>=E ARM_H.case_pde (returnOk None) (\<lambda>pt' x xa. returnOk (if pt' = addrFromPPtr ptPtr then Just pd else Nothing)) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. returnOk None) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. returnOk None)
odE <catch> (\<lambda>_. return None)) (\<acute>find_ret :== CALL findPDForASID_'proc(asida);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddra >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C (find_ret_' s) +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C \<acute>find_ret +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR_COERCE(pte_C \<rightarrow> unit) pt then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C (find_ret_' s))
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))))
 2. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1430 pt vaddra asida s \<and> s' \<in> ?Q'1430 pt vaddra asida proof (prove)
goal (2 subgoals):
 1. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1430 (pte_Ptr ptPtr) vaddr asid) (?Q'1430 (pte_Ptr ptPtr) vaddr asid) [SKIP] (findPDForASID asid >>= case_sum (case_sum (\<lambda>e. return None) return \<circ> Inl) (\<lambda>rv. do r <- getObject (lookup_pd_slot rv vaddr);
(case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None) >>= case_sum (\<lambda>e. return None) return
od)) (\<acute>find_ret :== CALL findPDForASID_'proc(asida);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C (find_ret_' s) +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C \<acute>find_ret +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C (find_ret_' s))
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))))
 2. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1430 pt vaddra asida s \<and> s' \<in> ?Q'1430 pt vaddra asida proof (prove)
goal (8 subgoals):
 1. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ccorres (?f'1437 pt vaddra asida \<currency> ?r'1437 pt vaddra asida) (liftxf (?es1437 pt vaddra asida) (?ef'1437 pt vaddra asida) (?vf'1437 pt vaddra asida) (?xf'1437 pt vaddra asida)) (?P1443 (pte_Ptr ptPtr) vaddr asid) (?Q'1430 (pte_Ptr ptPtr) vaddr asid) [] (findPDForASID asid) (\<acute>find_ret :== CALL findPDForASID_'proc(asida))
 2. \<And>pt vaddra asida rv' t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1437 pt vaddra asida) rv' t t' (IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C (find_ret_' s) +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C \<acute>find_ret +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C (find_ret_' s))
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))) (?d'1437 pt vaddra asida rv')
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; ?r'1437 pt vaddra asida rv (?vf'1437 pt vaddra asida rv'); ?ef'1437 pt vaddra asida rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 pt vaddra asida rv) (?Q'1437 pt vaddra asida rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
a <- case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1437 pt vaddra asida rv')
 4. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; ?ef'1437 pt vaddra asida rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'1437 pt vaddra asida err (?ef'1437 pt vaddra asida rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'1437 pt vaddra asida rv')
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. ?r'1437 pt vaddra asida rv (?vf'1437 pt vaddra asida rv')) (?xf'1437 pt vaddra asida) (\<lambda>rv rv'. {s. ?ef'1437 pt vaddra asida rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'1437 pt vaddra asida rv rv'})
 7. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ?f'1437 pt vaddra asida err (?ef'1437 pt vaddra asida rv)) (?es1437 pt vaddra asida) (\<lambda>rv rv'. {s. ?ef'1437 pt vaddra asida (?xf'1437 pt vaddra asida s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 8. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1443 pt vaddra asida and ?R1441 pt vaddra asida) s \<and> s' \<in> ?Q'1430 pt vaddra asida proof (prove)
goal (8 subgoals):
 1. ccorres (?f'1437 (pte_Ptr ptPtr) vaddr asid \<currency> ?r'1437 (pte_Ptr ptPtr) vaddr asid) (liftxf (?es1437 (pte_Ptr ptPtr) vaddr asid) (?ef'1437 (pte_Ptr ptPtr) vaddr asid) (?vf'1437 (pte_Ptr ptPtr) vaddr asid) (?xf'1437 (pte_Ptr ptPtr) vaddr asid)) (?P1443 (pte_Ptr ptPtr) vaddr asid) (?Q'1430 (pte_Ptr ptPtr) vaddr asid) [] (findPDForASID asid) (\<acute>find_ret :== CALL findPDForASID_'proc(asid))
 2. \<And>pt vaddra asida rv' t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1437 pt vaddra asida) rv' t t' (IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C (find_ret_' s) +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C \<acute>find_ret +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C (find_ret_' s))
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))) (?d'1437 pt vaddra asida rv')
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; ?r'1437 pt vaddra asida rv (?vf'1437 pt vaddra asida rv'); ?ef'1437 pt vaddra asida rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 pt vaddra asida rv) (?Q'1437 pt vaddra asida rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
a <- case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1437 pt vaddra asida rv')
 4. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; ?ef'1437 pt vaddra asida rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'1437 pt vaddra asida err (?ef'1437 pt vaddra asida rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'1437 pt vaddra asida rv')
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. ?r'1437 pt vaddra asida rv (?vf'1437 pt vaddra asida rv')) (?xf'1437 pt vaddra asida) (\<lambda>rv rv'. {s. ?ef'1437 pt vaddra asida rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'1437 pt vaddra asida rv rv'})
 7. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ?f'1437 pt vaddra asida err (?ef'1437 pt vaddra asida rv)) (?es1437 pt vaddra asida) (\<lambda>rv rv'. {s. ?ef'1437 pt vaddra asida (?xf'1437 pt vaddra asida s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 8. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1443 pt vaddra asida and ?R1441 pt vaddra asida) s \<and> s' \<in> ?Q'1430 pt vaddra asida proof (prove)
goal (7 subgoals):
 1. \<And>pt vaddra asida rv' t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> find_ret_' rv' t t' (IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C (find_ret_' s) +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C \<acute>find_ret) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C \<acute>find_ret +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C (find_ret_' s))
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))) (?d'1437 pt vaddra asida rv')
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 pt vaddra asida rv) (?Q'1437 pt vaddra asida rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
a <- case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1437 pt vaddra asida rv')
 3. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'1437 pt vaddra asida rv')
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'1437 pt vaddra asida rv rv'})
 6. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 7. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (6 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 pt vaddra asida rv) (?Q'1437 pt vaddra asida rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
a <- case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'1437 pt vaddra asida rv rv'})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (6 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 (pte_Ptr ptPtr) vaddr asid rv) (?Q'1437 (pte_Ptr ptPtr) vaddr asid rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
(case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None) >>= case_sum (\<lambda>e. return None) return
od) (\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pde_Ptr rv) (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + pdIndex_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pde_Ptr rv) (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + \<acute>pdIndex * 4)))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'1437 pt vaddra asida rv rv'})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (6 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1437 (pte_Ptr ptPtr) vaddr asid rv) (?G'1742 (pte_Ptr ptPtr) vaddr asid rv rv') [SKIP] (do r <- getObject (lookup_pd_slot rv vaddr);
(case r of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None) >>= case_sum (\<lambda>e. return None) return
od) (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (unat (vaddr >> 20)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4)} (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (Suc (unat (vaddr >> 20))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + (vaddr >> 20) * 4)))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>?Q1437 pt vaddra asida\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> ?G'1742 pt vaddra asida rv rv'}})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres cpde_relation pde_' (?P1979 (pte_Ptr ptPtr) vaddr asid rv) (?G'1742 (pte_Ptr ptPtr) vaddr asid rv rv') [] (getObject (lookup_pd_slot rv vaddr)) (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (unat (vaddr >> 20)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4)} (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (Suc (unat (vaddr >> 20))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + (vaddr >> 20) * 4))))))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. ?P1979 pt vaddra asida a and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> ?G'1742 pt vaddra asida rv rv'}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv' x. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres cpde_relation pde_' (\<lambda>a. ?P1987 (pte_Ptr ptPtr) vaddr asid rv a x) (?P'1988 (pte_Ptr ptPtr) vaddr asid rv rv' x) [] (return x) (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (unat (vaddr >> 20)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4)} (Guard MemorySafety \<lbrace>vaddr >> 20 = 0 \<or> array_assertion (pde_Ptr rv) (Suc (unat (vaddr >> 20))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + (vaddr >> 20) * 4))))))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> ?P1987 pt vaddra asida a b pde) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'1988 pt vaddra asida rv rv' pde}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv' x. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres cpde_relation pde_' (?A2007 (pte_Ptr ptPtr) vaddr asid rv x) (?C'2004 (pte_Ptr ptPtr) vaddr asid rv rv' x) [] (return x) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4)} (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + (vaddr >> 20) * 4))))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (?A2007 pt vaddra asida a pde and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?C'2004 pt vaddra asida rv rv' pde \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv' x. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ko_at' x (lookup_pd_slot rv vaddr) and no_0_obj' and page_directory_at' rv) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4)} (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (rv + (vaddr >> 20) * 4))) {s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> cpde_relation rv (pde_' s)}
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv' x \<sigma>. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. (ko_at' x (lookup_pd_slot rv vaddr) and no_0_obj' and page_directory_at' rv) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4) \<and> (\<exists>(rva, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', pde_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (pde_Ptr (rv + (vaddr >> 20) * 4))) s) \<in> rf_sr \<and> cpde_relation rva (h_val (hrs_mem (t_hrs_' (globals s))) (pde_Ptr (rv + (vaddr >> 20) * 4))))}
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' x \<sigma> xa. \<lbrakk>pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ko_at' x (rv + (vaddr >> 20 << 2)) \<sigma>; no_0_obj' \<sigma>; page_directory_at' rv \<sigma>; (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4) \<and> cpde_relation x (h_val (hrs_mem (t_hrs_' (globals xa))) (pde_Ptr (rv + (vaddr >> 20) * 4)))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' x \<sigma> xa. \<lbrakk>pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ko_at' x (rv + (vaddr >> 20 << 2)) \<sigma>; no_0_obj' \<sigma>; (\<sigma>, xa) \<in> rf_sr; cslift xa (pd_Ptr rv) \<noteq> None\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4) \<and> cpde_relation x (h_val (hrs_mem (t_hrs_' (globals xa))) (pde_Ptr (rv + (vaddr >> 20) * 4)))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' x \<sigma> xa y'. \<lbrakk>pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ko_at' x (rv + (vaddr >> 20 << 2)) \<sigma>; no_0_obj' \<sigma>; cslift xa (pd_Ptr rv) \<noteq> None; map_to_pdes (ksPSpace \<sigma>) (rv + (vaddr >> 20 << 2)) = Some x; cpde_relation x y'; cslift xa (pde_Ptr (rv + (vaddr >> 20 << 2))) = Some y'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c pde_Ptr (rv + (vaddr >> 20) * 4) \<and> cpde_relation x (h_val (hrs_mem (t_hrs_' (globals xa))) (pde_Ptr (rv + (vaddr >> 20) * 4)))
 2. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (9 subgoals):
 1. \<And>pt vaddra asida rv rv' rv'a t t'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> pde_' rv'a t t' (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))) (?d'1972 pt vaddra asida rv rv' rv'a)
 2. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (?d'1972 pt vaddra asida rv rv' rv'a)
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 5. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 8. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 9. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?Q1972 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(rv'a);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>?Q1972 pt vaddra asida rv rv'\<rbrace>
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 4. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 7. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 8. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a; rv \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?G2211 pt vaddra asida rv rv' rva) (?Q'1972 pt vaddra asida rv rv' rva rv'a) [SKIP] (do a <- case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None;
case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a
od) (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(rv'a);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)))
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. ?G2211 pt vaddra asida rv rv' rva and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (?Q'1972 pt vaddra asida rv rv')
 4. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 7. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 8. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?G2211 pt vaddra asida rv rv' rva) (?G'2332 pt vaddra asida rv rv' rva rv'a ret__unsigned) [SKIP] ((case rva of ARM_H.PageTablePDE pt' x xa \<Rightarrow> returnOk (if pt' = addrFromPPtr ptPtr then Just rv else Nothing) | _ \<Rightarrow> returnOk None) >>= case_sum (\<lambda>e. return None) return) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. ?G2211 pt vaddra asida rv rv' rva and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 3. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. \<forall>v. v = pde_get_tag (pde_' (pde_'_update (\<lambda>_. rv'a) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?G'2332 pt vaddra asida rv rv' rva rv'a v}})
 4. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 pt vaddra asida err) (?Q''1437 pt vaddra asida err rv' err') [SKIP] (((\<lambda>a. case a of Inl e \<Rightarrow> return None | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(\<acute>pde);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(\<acute>pde);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. (\<lambda>b. \<forall>pde. ko_at' pde (lookup_pd_slot a vaddra) b \<longrightarrow> (ko_at' pde (lookup_pd_slot a vaddra) and no_0_obj' and page_directory_at' a and page_directory_at' a and page_directory_at' a) b) and ?R1977 pt vaddra asida a\<rbrace>, \<lbrace>?QE1437 pt vaddra asida\<rbrace>
 6. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. pdIndex_'_update (\<lambda>_. vaddra >> 20) s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>Suc (unat (vaddra >> 20)) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> Suc (unat (vaddra >> 20)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (vaddra >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddra >> 20 \<noteq> 0 \<longrightarrow> unat (vaddra >> 20) \<noteq> 0)\<rbrace>}}})
 7. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 pt vaddra asida err rv rv'})
 8. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1441 pt vaddra asida) s \<and> s' \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} proof (prove)
goal (11 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x21 x22 x23. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.PageTablePDE x21 x22 x23) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) x21 x22 x23) (?R''2476 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) rv'a (pde_get_tag rv'a) x21 x22 x23) [SKIP] (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing)) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2476 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) rv'a (pde_get_tag rv'a) x xa xb) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x21 x22 x23. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.PageTablePDE x21 x22 x23) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) x21 x22 x23) (?R''2476 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) rv'a (pde_get_tag rv'a) x21 x22 x23) [SKIP] (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing)) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2476 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) rv'a (pde_get_tag rv'a) x xa xb) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x21 x22 x23. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.PageTablePDE x21 x22 x23) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) x21 x22 x23) (?R'2487 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x21 x22 x23) rv'a (pde_get_tag rv'a) x21 x22 x23) [SKIP] (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing)) (\<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R2472 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R'2487 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.PageTablePDE x xa xb) rv'a (pde_get_tag rv'a) x xa xb \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x21 x22 x23. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.PageTablePDE x21 x22 x23) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__ptr_to_struct_pde_C_' s = option_to_ptr rv \<and> rv \<noteq> Some 0}
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x21 x22 x23 \<sigma>. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.PageTablePDE x21 x22 x23) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<and> (\<forall>t. ret__unsigned_' t = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a) \<longrightarrow> (\<forall>t. ret__ptr_to_void_' t = PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))) \<longrightarrow> ((if PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))) = PTR(unit) ptPtr then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rva, \<sigma>')\<in>fst (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a), ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))), ret__int_' := if PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))) = PTR(unit) ptPtr then 1 else 0, ret__ptr_to_struct_pde_C_' := pde_Ptr rv, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> pde_Ptr rv = option_to_ptr rva \<and> rva \<noteq> Some 0)) \<and> ((if PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))) = PTR(unit) ptPtr then 1 else 0) = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (if x21 = addrFromPPtr ptPtr then Just rv else Nothing) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a), ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift rv'a))), ret__int_' := 0, ret__ptr_to_struct_pde_C_' := NULL, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> NULL = option_to_ptr rv \<and> rv \<noteq> Some 0))))}
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' rv'a x21 x22 x23 \<sigma> x. \<lbrakk>pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pde_lift rv'a = Some (Pde_pde_coarse \<lparr>pde_pde_coarse_CL.address_CL = x21, P_CL = of_bool x22, Domain_CL = x23\<rparr>); rv \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<and> ((\<exists>t. ret__unsigned_' t = x21) \<longrightarrow> (\<exists>t. ret__ptr_to_void_' t = PTR(unit) (ptrFromPAddr x21)) \<longrightarrow> (ptrFromPAddr x21 = ptPtr \<longrightarrow> pde_Ptr rv = option_to_ptr (if x21 = ptPtr - pptrBaseOffset then Just rv else Nothing) \<and> (if x21 = ptPtr - pptrBaseOffset then Just rv else Nothing) \<noteq> Some 0) \<and> (ptrFromPAddr x21 \<noteq> ptPtr \<longrightarrow> NULL = option_to_ptr (if x21 = ptPtr - pptrBaseOffset then Just rv else Nothing) \<and> (if x21 = ptPtr - pptrBaseOffset then Just rv else Nothing) \<noteq> Some 0))
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 6. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 7. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 9. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 10. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation ARM_H.InvalidPDE rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE) (?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 2. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x31 x32 x33 x34 x35 x36 x37. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) x31 x32 x33 x34 x35 x36 x37) (?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) rv'a (pde_get_tag rv'a) x31 x32 x33 x34 x35 x36 x37) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 3. \<And>pt vaddra asida rv rv' rva rv'a ret__unsigned x41 x42 x43 x44 x45 x46. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a; rv \<noteq> 0; ret__unsigned = pde_get_tag rv'a; rva = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) x41 x42 x43 x44 x45 x46) (?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) rv'a (pde_get_tag rv'a) x41 x42 x43 x44 x45 x46) [SKIP] (return None) (IF pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc(rv'a);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pde_Ptr rv)
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI)
 4. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> ?R2471 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE s) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R2473 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R2474 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) x xa xb xc xd xe s)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 5. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2475 (pte_Ptr ptPtr) vaddr asid rv rv' ARM_H.InvalidPDE rv'a (pde_get_tag rv'a)) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2477 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SectionPDE x xa xb xc xd xe xf) rv'a (pde_get_tag rv'a) x xa xb xc xd xe xf) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> ?R''2478 (pte_Ptr ptPtr) vaddr asid rv rv' (ARM_H.SuperSectionPDE x xa xb xc xd xe) rv'a (pde_get_tag rv'a) x xa xb xc xd xe)})
 6. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 8. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 9. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 10. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (7 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. (rva = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>)})
 3. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 6. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 7. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (7 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R1977 (pte_Ptr ptPtr) vaddr asid rv\<rbrace> getObject (lookup_pd_slot rv vaddr) \<lbrace>\<lambda>rva. (\<lambda>s. True) and (\<lambda>_. rv \<noteq> 0)\<rbrace>
 2. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>)})
 3. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ?R1977 (pte_Ptr ptPtr) vaddr asid a b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 5. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 6. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 7. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (6 subgoals):
 1. \<And>pt vaddra asida rv rv'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV cpde_relation pde_' (\<lambda>rva rv'a. {s. (rva = ARM_H.InvalidPDE \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb. rva = ARM_H.PageTablePDE x xa xb \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>) \<and> (\<forall>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s\<lparr>ret__unsigned_' := pde_get_tag rv'a, ret__int_' := if pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0\<rparr> \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>pde_get_tag rv'a = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse\<rbrace>)})
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' s rva. \<lbrakk>pd_C rv' = pde_Ptr rv; findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cpde_relation rva (pde_' s)\<rbrakk> \<Longrightarrow> (rva = ARM_H.InvalidPDE \<longrightarrow> NULL = option_to_ptr None \<and> pde_get_tag (pde_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) \<and> ((\<exists>x xa xb. rva = ARM_H.PageTablePDE x xa xb) \<longrightarrow> pde_get_tag (pde_' s) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) \<and> ((\<exists>x xa xb xc xd xe xf. rva = ARM_H.SectionPDE x xa xb xc xd xe xf) \<longrightarrow> NULL = option_to_ptr None \<and> pde_get_tag (pde_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) \<and> ((\<exists>x xa xb xc xd xe. rva = ARM_H.SuperSectionPDE x xa xb xc xd xe) \<longrightarrow> NULL = option_to_ptr None \<and> pde_get_tag (pde_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse)
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (5 subgoals):
 1. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (IF True THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 4. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 5. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (5 subgoals):
 1. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL);;
(\<acute>pdIndex :== vaddr >> 20;;
(Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (unat \<acute>pdIndex) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_C rv' +\<^sub>p uint (pdIndex_' s))} (Guard MemorySafety \<lbrace>\<acute>pdIndex = 0 \<or> array_assertion (pd_C rv') (Suc (unat \<acute>pdIndex)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>pde :== h_val (hrs_mem \<acute>t_hrs) (pd_C rv' +\<^sub>p uint \<acute>pdIndex))));;
(\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_get_address_'proc();;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__ptr_to_void = PTR(unit) ptPtr then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. pd_C rv')
ELSE
  return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 4. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''1437 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 5. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (6 subgoals):
 1. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ret__ptr_to_struct_pde_C_' (?QE1437 (pte_Ptr ptPtr) vaddr asid err) (?P'2844 (pte_Ptr ptPtr) vaddr asid err rv' err') [SKIP] (return None) (return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL))
 2. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2843 (pte_Ptr ptPtr) vaddr asid err rv' err') return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL) {},UNIV
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>?QE1437 (pte_Ptr ptPtr) vaddr asid\<rbrace>
 4. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 5. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?P'2844 (pte_Ptr ptPtr) vaddr asid err rv rv' \<inter> ?R'2843 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 6. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (5 subgoals):
 1. \<And>pt vaddra asida err rv' err'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; findPDForASID_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2843 (pte_Ptr ptPtr) vaddr asid err rv' err') return_C ret__ptr_to_struct_pde_C_'_update (\<lambda>s. NULL) {},UNIV
 2. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 4. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> ?R'2843 (pte_Ptr ptPtr) vaddr asid err rv rv'})
 5. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (4 subgoals):
 1. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R1441 (pte_Ptr ptPtr) vaddr asid\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. ((\<exists>pde. ko_at' pde (lookup_pd_slot a vaddr) b) \<longrightarrow> no_0_obj' b \<and> page_directory_at' a b) \<and> ((\<lambda>s. True) and (\<lambda>_. a \<noteq> 0)) b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 3. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> \<lbrace>True\<rbrace>})
 4. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> ?R1441 (pte_Ptr ptPtr) vaddr asid s proof (prove)
goal (3 subgoals):
 1. \<And>pt vaddra asida. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. pd_C rv' = pde_Ptr rv) find_ret_' (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>pde pde'. cslift s (pde_Ptr (lookup_pd_slot rv vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> Suc (unat (vaddr >> 20)) \<le> 2 ^ (pdBits - 2) \<and> unat (vaddr >> 20) \<le> 2 ^ (pdBits - 2) \<and> (vaddr >> 20 \<noteq> 0 \<longrightarrow> 0 < unat (vaddr >> 20))})
 2. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> \<lbrace>True\<rbrace>})
 3. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> True \<and> (no_0_obj' s \<and> True) \<and> True \<and> True proof (prove)
goal (2 subgoals):
 1. \<And>pt vaddra asida err. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. lookup_failure_rel err (findPDForASID_ret_C.status_C rv)) errstate (\<lambda>rv rv'. {s. findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> \<lbrace>NULL = option_to_ptr None \<and> None \<noteq> Some 0\<rbrace> \<inter> \<lbrace>True\<rbrace>})
 2. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> True \<and> (no_0_obj' s \<and> True) \<and> True \<and> True proof (prove)
goal (1 subgoal):
 1. \<And>pt vaddra asida s s'. \<lbrakk>pt = pte_Ptr ptPtr; vaddra = vaddr; asida = asid; (s, s') \<in> rf_sr; invs' s \<and> asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> valid_arch_state' s \<and> no_0_obj' s \<and> True \<and> (no_0_obj' s \<and> True) \<and> True \<and> True proof (prove)
goal:
No subgoals!