theory VSpace_C

lemma findFreeHWASID_ccorres:
  "ccorres (=) ret__unsigned_char_'
       (valid_arch_state' and valid_pde_mappings') UNIV []
       (findFreeHWASID) (Call findFreeHWASID_'proc)" apply (cinit) apply csymbr apply (rule ccorres_pre_gets_armKSHWASIDTable_ksArchState) apply (rule ccorres_pre_gets_armKSNextASID_ksArchState) apply (simp add: whileAnno_def case_option_find_give_me_a_map
                    mapME_def
               del: Collect_const map_append) apply (rule ccorres_splitE_novcg) apply (subgoal_tac "[nextASID .e. maxBound] @ init [minBound .e. nextASID]
                               = map (\<lambda>x. nextASID + (of_nat x)) [0 ..< 256]") apply (rule_tac xf=hw_asid_offset_' and i=0
                     and xf_update=hw_asid_offset_'_update
                     and r'=dc and xf'=xfdc and Q=UNIV
                     and F="\<lambda>n s. hwASIDTable = armKSHWASIDTable (ksArchState s)
                                  \<and> nextASID = armKSNextASID (ksArchState s)
                                  \<and> valid_arch_state' s"
                   in ccorres_sequenceE_while_gen') apply (rule ccorres_from_vcg_might_throw) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: rf_sr_armKSNextASID) apply (subst down_cast_same [symmetric],
                     simp add: is_down_def target_size_def source_size_def word_size)+ apply (simp add: ucast_ucast_mask
                               ucast_ucast_add ucast_and_mask
                               ucast_of_nat_small asidInvalid_def
                               word_sless_msb_less ucast_less[THEN order_less_le_trans]
                               word_0_sle_from_less) apply (simp add: word_sint_msb_eq not_msb_from_less word_of_nat_less
                               trans[OF msb_nth nth_ucast] bang_big word_size
                               uint_up_ucast is_up_def source_size_def
                               target_size_def) apply (rule conjI, rule order_trans[OF _ uint_add_ge0], simp) apply (simp add: rf_sr_armKSASIDTable_rel'
                               throwError_def return_def split: if_split) apply (clarsimp simp: returnOk_def return_def) apply (uint_arith, simp add: take_bit_nat_def unsigned_of_nat) apply (simp add: mask_def) apply unat_arith apply (rule conseqPre, vcg) apply clarsimp apply simp apply (rule hoare_pre, wp) apply simp apply simp apply simp apply simp apply (cut_tac x=nextASID in leq_maxBound[unfolded word_le_nat_alt]) apply (simp add: minBound_word init_def maxBound_word minus_one_norm) apply (simp add: upto_enum_word) apply (rule nth_equalityI) apply (simp del: upt.simps) apply (simp del: upt.simps) apply (simp add: nth_append
                 split: if_split) apply ceqv apply (rule ccorres_assert) apply (rule_tac A="\<lambda>s. nextASID = armKSNextASID (ksArchState s)
                             \<and> hwASIDTable = armKSHWASIDTable (ksArchState s)
                             \<and> valid_arch_state' s \<and> valid_pde_mappings' s"
                in ccorres_guard_imp2[where A'=UNIV]) apply (simp add: split_def) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=hw_asid_' in ccorres_abstract, ceqv) apply (rule_tac P="rv'a = nextASID" in ccorres_gen_asm2) apply (simp del: Collect_const) apply ((rule ccorres_move_const_guard )+)? apply (ctac(no_vcg) add: invalidateASID_ccorres) apply ((rule ccorres_move_const_guard
                    | simp only: ccorres_seq_simps)+)? apply (ctac(no_vcg) add: invalidateTranslationASID_ccorres) apply (rule ccorres_split_nothrow) apply (rule ccorres_move_const_guard )+ apply (rule ccorres_handlers_weaken) apply (rule invalidateHWASIDEntry_ccorres[OF refl]) apply ceqv apply (rule_tac P="\<lambda>s. nextASID = armKSNextASID (ksArchState s)"
                        in ccorres_from_vcg_throws[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp del: rf_sr_upd_safe) apply (clarsimp simp: rf_sr_def bind_def simpler_modify_def
                                  return_def cstate_relation_def Let_def) apply (simp add: carch_state_relation_def carch_globals_def
                             cmachine_state_relation_def) apply (subst down_cast_same [symmetric],
              simp add: is_down_def target_size_def source_size_def word_size)+ apply (clarsimp simp: maxBound_word minBound_word
                                  ucast_ucast_add minus_one_norm
                           split: if_split) apply (simp add: word_sint_msb_eq uint_up_ucast word_size
                             msb_nth nth_ucast bang_big is_up_def source_size_def
                             target_size_def) apply uint_arith subgoal by simp apply wp apply vcg apply simp apply wp[1] apply simp apply wp apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (drule_tac x=nextASID in bspec, simp) apply (clarsimp simp: rf_sr_armKSNextASID
                           rf_sr_armKSASIDTable_rel'
                           valid_arch_state'_def
                           valid_asid_map'_def
                           Collect_const_mem word_sless_msb_less
                           ucast_less[THEN order_less_le_trans]
                           word_0_sle_from_less) apply (frule(1) is_inv_SomeD, clarsimp) apply (drule subsetD, erule domI) apply simp apply (fold mapME_def) apply (wp mapME_wp') apply (rule hoare_pre, wp) apply simp apply (clarsimp simp: guard_is_UNIV_def) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (=) ret__unsigned_char_' (valid_arch_state' and valid_pde_mappings') UNIV [] findFreeHWASID (Call findFreeHWASID_'proc) proof (prove)
goal (2 subgoals):
 1. ccorres (=) ret__unsigned_char_' ?Q417 ?Q'417 [SKIP] (do hwASIDTable <- gets (armKSHWASIDTable \<circ> ksArchState);
nextASID <- gets (armKSNextASID \<circ> ksArchState);
case find (\<lambda>a. hwASIDTable a = None) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) of None \<Rightarrow> do invalidateASID $ fromJust $ hwASIDTable nextASID;
doMachineOp $ invalidateLocalTLB_ASID nextASID;
invalidateHWASIDEntry nextASID;
new_nextASID <- return (if nextASID = maxBound then minBound else nextASID + 1);
modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. new_nextASID) (ksArchState s)\<rparr>);
return nextASID
od | Some x \<Rightarrow> return x
od) (\<acute>hw_asid_offset :== 0;;
(WHILE \<acute>hw_asid_offset \<le> mask 8 DO
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1
OD;;
(\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_')))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 s \<and> s' \<in> ?Q'417 proof (prove)
goal (2 subgoals):
 1. ccorres (=) ret__unsigned_char_' ?Q417 ?G'425 [SKIP] (do hwASIDTable <- gets (armKSHWASIDTable \<circ> ksArchState);
nextASID <- gets (armKSNextASID \<circ> ksArchState);
case find (\<lambda>a. hwASIDTable a = None) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) of None \<Rightarrow> do invalidateASID $ fromJust $ hwASIDTable nextASID;
doMachineOp $ invalidateLocalTLB_ASID nextASID;
invalidateHWASIDEntry nextASID;
new_nextASID <- return (if nextASID = maxBound then minBound else nextASID + 1);
modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. new_nextASID) (ksArchState s)\<rparr>);
return nextASID
od | Some x \<Rightarrow> return x
od) (WHILE \<acute>hw_asid_offset \<le> mask 8 DO
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1
OD;;
(\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 s \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> ?G'425} proof (prove)
goal (2 subgoals):
 1. \<And>hwASIDTable. ccorres (=) ret__unsigned_char_' (?P545 hwASIDTable) (?P'545 hwASIDTable) [SKIP] (do nextASID <- gets (armKSNextASID \<circ> ksArchState);
case find (\<lambda>a. hwASIDTable a = None) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) of None \<Rightarrow> do invalidateASID $ fromJust $ hwASIDTable nextASID;
doMachineOp $ invalidateLocalTLB_ASID nextASID;
invalidateHWASIDEntry nextASID;
new_nextASID <- return (if nextASID = maxBound then minBound else nextASID + 1);
modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. new_nextASID) (ksArchState s)\<rparr>);
return nextASID
od | Some x \<Rightarrow> return x
od) (WHILE \<acute>hw_asid_offset \<le> mask 8 DO
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1
OD;;
(\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> ?P545 rv s) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> ?P'545 rv}} proof (prove)
goal (2 subgoals):
 1. \<And>hwASIDTable nextASID. ccorres (=) ret__unsigned_char_' (?P547 hwASIDTable nextASID) (?P'547 hwASIDTable nextASID) [SKIP] (case find (\<lambda>a. hwASIDTable a = None) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) of None \<Rightarrow> do invalidateASID $ fromJust $ hwASIDTable nextASID;
doMachineOp $ invalidateLocalTLB_ASID nextASID;
invalidateHWASIDEntry nextASID;
new_nextASID <- return (if nextASID = maxBound then minBound else nextASID + 1);
modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. new_nextASID) (ksArchState s)\<rparr>);
return nextASID
od | Some x \<Rightarrow> return x) (WHILE \<acute>hw_asid_offset \<le> mask 8 DO
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1
OD;;
(\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ?P547 rv rva s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rva. s \<in> ?P'547 rv rva}}} proof (prove)
goal (2 subgoals):
 1. \<And>hwASIDTable nextASID. ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?P547 hwASIDTable nextASID) (?P'547 hwASIDTable nextASID) [SKIP] (doE x <- sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]));
do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od
odE) (While \<lbrace>\<acute>hw_asid_offset \<le> mask 8\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1);;
(\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ?P547 rv rva s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rva. s \<in> ?P'547 rv rva}}} proof (prove)
goal (6 subgoals):
 1. \<And>hwASIDTable nextASID. ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'562 hwASIDTable nextASID)) (?xf'562 hwASIDTable nextASID) (inl_rrel ((=) \<circ> theLeft)) ret__unsigned_char_' (?P562 hwASIDTable nextASID) (?P'562 hwASIDTable nextASID) [SKIP] (sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) (While \<lbrace>\<acute>hw_asid_offset \<le> mask 8\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1))
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (?xf'562 hwASIDTable nextASID) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. ?r'562 hwASIDTable nextASID x rv' \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (?r'562 hwASIDTable nextASID)) (?xf'562 hwASIDTable nextASID) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> (?P562 rv rva and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rva. s \<in> ?P'562 rv rva \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'562 hwASIDTable nextASID)) (?xf'562 hwASIDTable nextASID) (inl_rrel ((=) \<circ> theLeft)) ret__unsigned_char_' (?P562 hwASIDTable nextASID) (?P'562 hwASIDTable nextASID) [SKIP] (sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) (While \<lbrace>\<acute>hw_asid_offset \<le> mask 8\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI));;
\<acute>hw_asid_offset :== \<acute>hw_asid_offset + 1))
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 3. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (?xf'562 hwASIDTable nextASID) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID x rv'. ?r'562 hwASIDTable nextASID x rv' \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (?r'562 hwASIDTable nextASID)) (?xf'562 hwASIDTable nextASID) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> (?P562 rv rva and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rva. s \<in> ?P'562 rv rva \<inter> UNIV}}} proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID n ys. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])); n = length ys\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (inl_rrel ((=) \<circ> theLeft))) ret__unsigned_char_' (\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) (UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat (0 + n) \<and> dc ys (xfdc s)}) [SKIP] (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n) (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID n ys. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])); n = length ys\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (hwASIDTable = armKSHWASIDTable (ksArchState \<sigma>) \<and> nextASID = armKSNextASID (ksArchState \<sigma>) \<and> valid_arch_state' \<sigma>) \<and> s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat (0 + n) \<and> dc ys (xfdc s)} \<and> (\<sigma>, s) \<in> rf_sr} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) {s. \<exists>(rv, \<sigma>')\<in>fst ((map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [rv])) rv (xfdc s)},{s. \<exists>(rv, \<sigma>')\<in>fst ((map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (inl_rrel ((=) \<circ> theLeft)) rv (ret__unsigned_char_' s)}
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID n ys \<sigma>. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])); n = length ys\<rbrakk> \<Longrightarrow> {s. (hwASIDTable = armKSHWASIDTable (ksArchState \<sigma>) \<and> nextASID = armKSNextASID (ksArchState \<sigma>) \<and> valid_arch_state' \<sigma>) \<and> s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat (0 + n) \<and> dc ys (xfdc s)} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. - 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))) \<le> 2147483647 \<and> UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s)))) <s 0x100 \<and> 0 \<le>s UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s)))) \<and> (armKSHWASIDTable_' (globals s).[unat (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))))] = SCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n) \<sigma>). (\<sigma>', s\<lparr>hw_asid_' := SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))), ret__unsigned_char_' := SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s)))))) \<and> (armKSHWASIDTable_' (globals s).[unat (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s))))] \<noteq> SCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n) \<sigma>). (\<sigma>', hw_asid_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s)))) s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [rv])) rv (xfdc (hw_asid_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (hw_asid_offset_' s)))) s))))}
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))) \<le> 2147483647 \<and> UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) <s 0x100 \<and> 0 \<le>s UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) \<and> (armKSHWASIDTable_' (globals x).[unat (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))))] = SCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))))) \<and> (armKSHWASIDTable_' (globals x).[unat (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))))] \<noteq> SCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))) \<le> 2147483647 \<and> UCAST(8 \<rightarrow> 32 signed) (UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) <s 0x100 \<and> 0 \<le>s UCAST(8 \<rightarrow> 32 signed) (UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) \<and> (armKSHWASIDTable_' (globals x).[unat (UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))))] = UCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). (\<sigma>', x) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))))) \<and> (armKSHWASIDTable_' (globals x).[unat (UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys)))))] \<noteq> UCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) (word_of_nat (length ys))))) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (word_of_nat (length ys)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) + sint (word_of_nat (length ys)) \<le> 2147483647 \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). (\<sigma>', x) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)))) \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<and> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<le> 2147483647 \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] = 0 \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)))) \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] \<noteq> 0 \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<le> 2147483647 \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] = 0 \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inl_rrel (inl_rrel (\<lambda>x. (=) (theLeft x))) rv (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)))) \<and> (armKSHWASIDTable_' (globals x).[unat (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys))] \<noteq> 0 \<longrightarrow> (\<exists>xa\<in>fst ((if armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None then throwError (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) else returnOk ()) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = None \<longrightarrow> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<le> 2147483647) \<and> ((\<exists>y. armKSHWASIDTable (ksArchState \<sigma>) (armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) = Some y) \<longrightarrow> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<le> 2147483647 \<and> (\<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', x) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [()])) rv (xfdc (hw_asid_'_update (\<lambda>_. armKSNextASID (ksArchState \<sigma>) + word_of_nat (length ys)) x))))
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ys \<sigma> x. \<lbrakk>[armKSNextASID (ksArchState \<sigma>) .e. maxBound] @ init [minBound .e. armKSNextASID (ksArchState \<sigma>)] = map (\<lambda>x. armKSNextASID (ksArchState \<sigma>) + word_of_nat x) [0..<256]; length ys < 256; valid_arch_state' \<sigma>; hw_asid_offset_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> uint (armKSNextASID (ksArchState \<sigma>)) + uint (word_of_nat (length ys)) \<le> 2147483647
 2. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 3. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 4. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 9. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>hwASIDTable nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> mask 8) = (n < word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))
 2. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 3. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 8. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 9. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>nextASID n. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> (n \<le> 0xFF) = (n < 0x100)
 2. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 3. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 8. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 9. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 10. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647\<rbrace> (\<acute>hw_asid :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)));;
Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (IF \<acute>armKSHWASIDTable.[unat \<acute>hw_asid] = SCAST(32 signed \<rightarrow> 32) asidInvalid THEN
  return_C ret__unsigned_char_'_update hw_asid_'
FI)) (UNIV \<inter> \<lbrace>\<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>),UNIV
 2. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 7. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 8. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable nextASID s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; s \<in> UNIV\<rbrakk> \<Longrightarrow> {s} \<subseteq> \<lbrace>- 2147483648 \<le> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) + sint (UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)) \<le> 2147483647 \<longrightarrow> UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset))) <s 0x100 \<longrightarrow> 0 \<le>s UCAST(8 \<rightarrow> 32 signed) (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset))) \<longrightarrow> \<acute>armKSHWASIDTable.[unat (SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + UCAST(8 \<rightarrow> 32 signed) (UCAST(32 \<rightarrow> 8) \<acute>hw_asid_offset)))] \<noteq> SCAST(32 signed \<rightarrow> 32) asidInvalid \<longrightarrow> \<acute>hw_asid_offset = \<^bsup>s\<^esup>hw_asid_offset\<rbrace>
 2. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 6. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 7. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 8. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) ! n \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 6. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 7. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 8. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 9. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (10 subgoals):
 1. \<And>hwASIDTable nextASID n. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < 256\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace> if hwASIDTable (nextASID + word_of_nat n) = None then throwError (nextASID + word_of_nat n) else returnOk () \<lbrace>\<lambda>_ s. hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrace>, -
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 6. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 7. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 8. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 9. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (10 subgoals):
 1. \<And>hwASIDTable nextASID n s. \<lbrakk>[nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]; n < 256; hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> (hwASIDTable (nextASID + word_of_nat n) = None \<longrightarrow> True) \<and> (hwASIDTable (nextASID + word_of_nat n) \<noteq> None \<longrightarrow> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> nextASID = armKSNextASID (ksArchState s) \<and> valid_arch_state' s)
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 6. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 7. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 8. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 9. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (9 subgoals):
 1. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> 0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) < 2 ^ LENGTH(32)
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 5. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 6. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 7. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 8. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. hw_asid_offset_' (hw_asid_offset_'_update f s) = f (hw_asid_offset_' s)
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 3. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 4. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 5. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 6. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 7. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] \<Longrightarrow> \<forall>s f. xfdc (hw_asid_offset_'_update f s) = xfdc s \<and> (hw_asid_offset_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', hw_asid_offset_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 2. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 3. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>hwASIDTable nextASID. [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>hwASIDTable nextASID. unat nextASID \<le> unat maxBound \<Longrightarrow> [nextASID .e. maxBound] @ init [minBound .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>nextASID. unat nextASID \<le> 255 \<Longrightarrow> [nextASID .e. 0xFF] @ take (unat nextASID) [0 .e. nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>nextASID. unat nextASID \<le> 255 \<Longrightarrow> map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID] = map (\<lambda>x. nextASID + word_of_nat x) [0..<256]
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>nextASID. unat nextASID \<le> 255 \<Longrightarrow> length (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID]) = length (map (\<lambda>x. nextASID + word_of_nat x) [0..<256])
 2. \<And>nextASID i. \<lbrakk>unat nextASID \<le> 255; i < length (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID])\<rbrakk> \<Longrightarrow> (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID]) ! i = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] ! i
 3. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>nextASID i. \<lbrakk>unat nextASID \<le> 255; i < length (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID])\<rbrakk> \<Longrightarrow> (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID]) ! i = map (\<lambda>x. nextASID + word_of_nat x) [0..<256] ! i
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>nextASID i. \<lbrakk>unat nextASID \<le> 255; i < 256\<rbrakk> \<Longrightarrow> (map word_of_nat [unat nextASID..<256] @ map word_of_nat [0..<unat nextASID]) ! i = nextASID + word_of_nat i
 2. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>hwASIDTable nextASID rv' t t'. ceqv \<Gamma> (\<lambda>s. (hw_asid_offset_' s, xfdc s)) rv' t t' (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))) (?d'562 hwASIDTable nextASID rv')
 2. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (?d'562 hwASIDTable nextASID rv')
 3. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 4. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))) \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (do _ <- assert (\<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y);
liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)
od) (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_')))))
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q562 hwASIDTable nextASID x) (?Q'562 hwASIDTable nextASID x rv') [SKIP] (liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)) (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_')))))
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>?Q562 hwASIDTable nextASID\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v. ?Q'562 hwASIDTable nextASID (theRight v))
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?Q'1540 hwASIDTable nextASID x rv') [SKIP] (liftM Inl (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od)) (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc(\<acute>hw_asid);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_')))))
 2. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 3. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?Q'1540 hwASIDTable nextASID x rv') [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (\<acute>hw_asid :== \<acute>armKSNextASID;;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_')))))
 2. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 3. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?Q'1552 hwASIDTable nextASID x rv') [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat \<acute>hw_asid])));;
(CALL invalidateTranslationASID_'proc();;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) \<acute>hw_asid\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat \<acute>hw_asid) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update hw_asid_'))))
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID (?Q'1552 hwASIDTable nextASID x rv')
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; ?Q1540 hwASIDTable nextASID x rv' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?G'1556 hwASIDTable nextASID x rv' rv'a) [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) rv'a <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) rv'a\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat rv'a])));;
(CALL invalidateTranslationASID_'proc(rv'a);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) rv'a <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) rv'a\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat rv'a) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. rv'a)))))
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> ?G'1556 hwASIDTable nextASID x rv' (hw_asid_' s)}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; ?Q1540 hwASIDTable nextASID x rv' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?G'1698 hwASIDTable nextASID x rv' rv'a) [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) rv'a <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) rv'a\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat rv'a])));;
(CALL invalidateTranslationASID_'proc(rv'a);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) rv'a <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) rv'a\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat rv'a) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. rv'a)))))
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> ?G'1698 hwASIDTable nextASID x rv' (hw_asid_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; ?Q1540 hwASIDTable nextASID x rv' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1540 hwASIDTable nextASID x rv') (?G'1698 hwASIDTable nextASID x rv' nextASID) [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat nextASID])));;
(CALL invalidateTranslationASID_'proc(nextASID);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)))))
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> ?G'1698 hwASIDTable nextASID x rv' (hw_asid_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; ?Q1540 hwASIDTable nextASID x rv' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1540 hwASIDTable nextASID x rv' s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?P1716 hwASIDTable nextASID x rv') (?G'1708 hwASIDTable nextASID nextASID x rv') [SKIP] (do y <- invalidateASID (the (hwASIDTable nextASID));
y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (CALL invalidateASID_'proc(\<acute>armKSHWASIDTable.[unat nextASID]);;
(CALL invalidateTranslationASID_'proc(nextASID);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)))))
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> ?G'1708 hwASIDTable nextASID (hw_asid_' s) x rv' \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (?P1716 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1716 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1722 hwASIDTable nextASID x rv' rv'a rv) (?Q'1740 hwASIDTable nextASID x rv' rv xfdc) [SKIP] (do y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (CALL invalidateTranslationASID_'proc(nextASID);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID))))
 2. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>?Q1722 hwASIDTable nextASID x rv' rv'a\<rbrace>
 3. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1739 hwASIDTable nextASID (hw_asid_' s) x rv' t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 4. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 5. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 6. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 7. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}}
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv. ?Q'1740 hwASIDTable nextASID x rv' rv (xfdc t) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?Q'1739 hwASIDTable nextASID nextASID proof (prove)
goal (8 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1722 hwASIDTable nextASID x rv' nextASID rv) (?Q'1740 hwASIDTable nextASID x rv' rv xfdc) [SKIP] (do y <- doMachineOp (invalidateLocalTLB_ASID nextASID);
y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (CALL invalidateTranslationASID_'proc(nextASID);;
(Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID))))
 2. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>?Q1722 hwASIDTable nextASID x rv' rv'a\<rbrace>
 3. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1739 hwASIDTable nextASID (hw_asid_' s) x rv' t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 4. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 5. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 6. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 7. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}}
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv. ?Q'1740 hwASIDTable nextASID x rv' rv (xfdc t) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?Q'1739 hwASIDTable nextASID nextASID proof (prove)
goal (9 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1775 hwASIDTable nextASID x rv' rv'a rv xfdca rva) (?Q'1793 hwASIDTable nextASID x rv' rv xfdca rva xfdc) [SKIP] (do y <- invalidateHWASIDEntry nextASID;
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid)));;
(Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>?Q1775 hwASIDTable nextASID x rv' rv'a rv xfdc\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 4. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'1794 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 5. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 6. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 7. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 8. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}}
flex-flex pairs:
\<lambda>hwASIDTable nextASID. ?Q'1794 hwASIDTable nextASID nextASID \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?Q'1793 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?P1837 hwASIDTable nextASID x rv' rv'a rv xfdca rva) (?P'1833 hwASIDTable nextASID x rv' rv xfdca rva xfdc) [SKIP] (invalidateHWASIDEntry nextASID) (Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b t t'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) rv'b t t' (Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y) (?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b) [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdc) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s) \<longrightarrow> s \<in> ?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s)}
 6. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. ?P1837 hwASIDTable nextASID x rv' rv'a rv xfdc a and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 7. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 8. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?P'1831 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 9. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 10. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
A total of 13 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?P'1833 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?P'1831 hwASIDTable nextASID nextASID
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?P1853 hwASIDTable nextASID x rv' rv'a rv xfdca rva) (?P'1833 hwASIDTable nextASID x rv' rv xfdca rva xfdc) [SKIP] (invalidateHWASIDEntry nextASID) (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b t t'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) rv'b t t' (Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y) (?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b) [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdc) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s) \<longrightarrow> s \<in> ?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s)}
 6. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. ?P1853 hwASIDTable nextASID x rv' rv'a rv xfdc a and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 7. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 8. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?P'1831 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 9. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 10. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
A total of 13 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?P'1833 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?P'1831 hwASIDTable nextASID nextASID
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (13 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) (?P1853 hwASIDTable nextASID x rv' rv'a rv xfdca rva) (?P'1833 hwASIDTable nextASID x rv' rv xfdca rva xfdc) [] (invalidateHWASIDEntry nextASID) (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b t t'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc) rv'b t t' (Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y) (?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b) [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdc) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. ?r'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s) \<longrightarrow> s \<in> ?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y (?xf'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc s)}
 6. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. ?P1853 hwASIDTable nextASID x rv' rv'a rv xfdc a and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 7. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 8. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?P'1831 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 9. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 10. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
A total of 13 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?P'1833 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?P'1831 hwASIDTable nextASID nextASID
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (12 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb rv'b t t'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>armKSNextASID :== SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID)) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb rv'b)
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; dc y rv'b\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y) (?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b) [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (?d'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc rv'b)
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<rbrace>
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb y (xfdc s)}
 5. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 7. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 8. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 9. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 10. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
A total of 12 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; dc y rv'b\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> theLeft \<circ> Inl) ret__unsigned_char_' (?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y) (?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b) [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) (Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>globals :== armKSNextASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1)));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>?Q1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb y (xfdc s)}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; dc y rv'b\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. nextASID = armKSNextASID (ksArchState \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard SignedArithmetic \<lbrace>0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<and> sint (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID) \<le> 2147483646\<rbrace> (\<acute>globals :== armKSNextASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) \<acute>armKSNextASID + 1)));;
return_C ret__unsigned_char_'_update (\<lambda>s. nextASID) {},{s. \<exists>(rv, \<sigma>')\<in>fst ((do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> theLeft \<circ> Inl) rv (ret__unsigned_char_' s)}
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc y rv'b \<sigma>. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc; dc y rv'b\<rbrakk> \<Longrightarrow> {s. nextASID = armKSNextASID (ksArchState \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s))) \<le> 2147483646 \<and> (\<exists>(rv, \<sigma>')\<in>fst ((do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if nextASID = maxBound then minBound else nextASID + 1) (ksArchState s)\<rparr>);
return nextASID
od) \<sigma>). (\<sigma>', globals_update (armKSNextASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals s)) + 1))) s\<lparr>ret__unsigned_char_' := nextASID, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> theLeft (Inl rv) = nextASID)}
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [minBound .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x))) \<le> 2147483646 \<and> (\<exists>xa\<in>fst ((do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSNextASID_update (\<lambda>_. if armKSNextASID (ksArchState \<sigma>) = maxBound then minBound else armKSNextASID (ksArchState \<sigma>) + 1) (ksArchState s)\<rparr>);
return (armKSNextASID (ksArchState \<sigma>))
od) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (armKSNextASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x)) + 1))) x\<lparr>ret__unsigned_char_' := armKSNextASID (ksArchState \<sigma>), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> rv = armKSNextASID (ksArchState \<sigma>))
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [minBound .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x))) \<le> 2147483646 \<and> carch_state_relation (armKSNextASID_update (\<lambda>_. if armKSNextASID (ksArchState \<sigma>) = maxBound then minBound else armKSNextASID (ksArchState \<sigma>) + 1) (ksArchState \<sigma>)) (globals x\<lparr>armKSNextASID_' := SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x)) + 1)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>armKSNextASID_' := SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID_' (globals x)) + 1)\<rparr>)
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [minBound .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD'' \<and> armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<le> 2147483646 \<and> SCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + 1) = (if armKSNextASID (ksArchState \<sigma>) = maxBound then minBound else armKSNextASID (ksArchState \<sigma>) + 1)
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [minBound .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD'' \<and> armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<le> 2147483646 \<and> UCAST(32 signed \<rightarrow> 8) (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>)) + 1) = (if armKSNextASID (ksArchState \<sigma>) = maxBound then minBound else armKSNextASID (ksArchState \<sigma>) + 1)
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [0 .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; armKSNextASID (ksArchState \<sigma>) \<noteq> 0xFF\<rbrakk> \<Longrightarrow> 0 \<le> 2147483649 + sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<and> sint (UCAST(8 \<rightarrow> 32 signed) (armKSNextASID (ksArchState \<sigma>))) \<le> 2147483646
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x. \<lbrakk>\<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [0 .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; armKSNextASID (ksArchState \<sigma>) \<noteq> 0xFF\<rbrakk> \<Longrightarrow> uint (armKSNextASID (ksArchState \<sigma>)) \<le> 2147483646
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (11 subgoals):
 1. \<And>hwASIDTable \<sigma> x i ia ib ic id ie if ig ih ii ij ik il im. \<lbrakk>0 \<le> ib; ib < 2 ^ LENGTH(32); 0 \<le> ic; ic < 2 ^ LENGTH(32); 0 \<le> id; id < 2 ^ LENGTH(8); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); 0 \<le> ie; ie < 2 ^ LENGTH(32); armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; 0 \<le> if; if < 2 ^ LENGTH(8); if \<noteq> 255; \<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>))) \<union> set (init [0 .e. armKSNextASID (ksArchState \<sigma>)]). \<exists>y. hwASIDTable x = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); 0 \<le> i; i < 2 ^ LENGTH(32); 0 \<le> ig; ig < 2 ^ LENGTH(32); ig = i; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; 0 \<le> ia; ia < 2 ^ LENGTH(32); 0 \<le> ih; ih < 2 ^ LENGTH(32); ih = ia; 0 \<le> ii; ii < 2 ^ LENGTH(32); ii = ib; 0 \<le> ij; ij < 2 ^ LENGTH(32); ij = ic; 0 \<le> ik; ik < 2 ^ LENGTH(8); ik = id; 0 \<le> il; il < 2 ^ LENGTH(32); il = ie; 0 \<le> im; im < 2 ^ LENGTH(8); uint (UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>)) = ib; uint (ksDomainTime \<sigma>) = ic; uint (armKSNextASID (ksArchState \<sigma>)) = id; uint (symbol_table ''armKSGlobalPD'') = ie; uint (armKSNextASID (ksArchState \<sigma>)) = if; uint (ksWorkUnitsCompleted \<sigma>) = i; uint (ksWorkUnitsCompleted_' (globals x)) = ig; uint (word_of_nat (ksDomScheduleIdx \<sigma>)) = ia; uint (ksDomScheduleIdx_' (globals x)) = ih; uint (ksCurDomain_' (globals x)) = ii; uint (ksDomainTime_' (globals x)) = ij; uint (armKSNextASID_' (globals x)) = ik; uint (armKSGlobalPD (ksArchState \<sigma>)) = il; uint (armKSNextASID (ksArchState \<sigma>)) = im\<rbrakk> \<Longrightarrow> im \<le> 2147483646
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 6. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 7. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 8. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 9. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 10. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> ib_; ib_ < 2 ^ LENGTH(32); 0 \<le> ic_; ic_ < 2 ^ LENGTH(32); 0 \<le> id_; id_ < 2 ^ LENGTH(8); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); 0 \<le> ie_; ie_ < 2 ^ LENGTH(32); armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; 0 \<le> if_; if_ < 2 ^ LENGTH(8); if_ \<noteq> 255; \<forall>x\<in>Collect ((\<le>) (armKSNextASID (ksArchState \<sigma>_))) \<union> set (init [0 .e. armKSNextASID (ksArchState \<sigma>_)]). \<exists>y. hwASIDTable_ x = Some y; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); 0 \<le> i_; i_ < 2 ^ LENGTH(32); 0 \<le> ig_; ig_ < 2 ^ LENGTH(32); ig_ = i_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; 0 \<le> ia_; ia_ < 2 ^ LENGTH(32); 0 \<le> ih_; ih_ < 2 ^ LENGTH(32); ih_ = ia_; 0 \<le> ii_; ii_ < 2 ^ LENGTH(32); ii_ = ib_; 0 \<le> ij_; ij_ < 2 ^ LENGTH(32); ij_ = ic_; 0 \<le> ik_; ik_ < 2 ^ LENGTH(8); ik_ = id_; 0 \<le> il_; il_ < 2 ^ LENGTH(32); il_ = ie_; 0 \<le> im_; im_ < 2 ^ LENGTH(8); uint (UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_)) = ib_; uint (ksDomainTime \<sigma>_) = ic_; uint (armKSNextASID (ksArchState \<sigma>_)) = id_; uint (symbol_table ''armKSGlobalPD'') = ie_; uint (armKSNextASID (ksArchState \<sigma>_)) = if_; uint (ksWorkUnitsCompleted \<sigma>_) = i_; uint (ksWorkUnitsCompleted_' (globals x_)) = ig_; uint (word_of_nat (ksDomScheduleIdx \<sigma>_)) = ia_; uint (ksDomScheduleIdx_' (globals x_)) = ih_; uint (ksCurDomain_' (globals x_)) = ii_; uint (ksDomainTime_' (globals x_)) = ij_; uint (armKSNextASID_' (globals x_)) = ik_; uint (armKSGlobalPD (ksArchState \<sigma>_)) = il_; uint (armKSNextASID (ksArchState \<sigma>_)) = im_\<rbrakk> \<Longrightarrow> im_ \<le> 2147483646 proof (prove)
goal (10 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1835 hwASIDTable nextASID x rv' rv'a rv xfdca rva\<rbrace> invalidateHWASIDEntry nextASID \<lbrace>\<lambda>a b. nextASID = armKSNextASID (ksArchState b)\<rbrace>
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and ?R1835 hwASIDTable nextASID x rv' rv'a rv xfdc a\<rbrace>
 4. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 5. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 6. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 7. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 8. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 9. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}}
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (9 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1825 hwASIDTable nextASID x rv' rv'a rv xfdca rva xfdcb\<^esub> (?R'1832 hwASIDTable nextASID x rv' rv xfdca rva xfdcb) Guard ArrayBounds \<lbrace>UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID\<rbrace> (\<acute>armKSHWASIDTable :== Arrays.update \<acute>armKSHWASIDTable (unat nextASID) (SCAST(32 signed \<rightarrow> 32) asidInvalid))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and (\<lambda>a. nextASID = armKSNextASID (ksArchState a))\<rbrace>
 3. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 4. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> UNIV \<inter> ?R'1830 hwASIDTable nextASID (hw_asid_' s) x rv' t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 5. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 6. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 7. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 8. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}}
flex-flex pairs:
\<lambda>hwASIDTable nextASID x rv' t rv ta rva. ?R'1832 hwASIDTable nextASID x rv' rv (xfdc t) rva (xfdc ta) \<equiv>\<^sup>? \<lambda>hwASIDTable nextASID. ?R'1830 hwASIDTable nextASID nextASID proof (prove)
goal (8 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a rv xfdc. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' rv\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a. (\<lambda>a. True) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100) and (\<lambda>a. nextASID = armKSNextASID (ksArchState a))\<rbrace>
 2. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 3. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 4. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 5. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 6. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 7. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1787 hwASIDTable nextASID nextASID x rv' ()\<rbrace> doMachineOp (invalidateLocalTLB_ASID nextASID) \<lbrace>\<lambda>a b. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState b)\<rbrace>
 2. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1787 hwASIDTable nextASID rv'a x rv' a\<rbrace>
 3. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 4. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 5. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 6. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 7. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) rv'a \<and> UCAST(8 \<rightarrow> 32 signed) rv'a <s 0x100 \<and> rv'a = armKSNextASID (ksArchState a))\<rbrace>
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>hwASIDTable nextASID x rv' rv'a. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; rv'a = nextASID\<rbrakk> \<Longrightarrow> \<lbrace>?R1732 hwASIDTable nextASID x rv'\<rbrace> invalidateASID (the (hwASIDTable nextASID)) \<lbrace>\<lambda>a b. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState b)\<rbrace>
 2. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 3. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 4. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and ?R1732 hwASIDTable nextASID x rv' and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 5. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 6. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>hwASIDTable nextASID x rv'. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv') \<acute>hw_asid :== \<acute>armKSNextASID {s. s \<in> {sa. asid_'_update (\<lambda>_. armKSHWASIDTable_' (globals sa).[unat (hw_asid_' s)]) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (hwASIDTable \<^bsup>s\<^esup>hw_asid)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. hw_asid_'_update (\<lambda>x. hw_asid_' s) sa \<in> \<lbrace>\<acute>hw_asid = \<^bsup>s\<^esup>hw_asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>\<^bsup>s\<^esup>hw_asid = nextASID\<rbrace>}
 2. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1540 hwASIDTable nextASID x rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 3. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> ?Q'1540 hwASIDTable nextASID x rv'
 4. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 5. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>hw_asid :== \<acute>armKSNextASID {s'. (s, s') \<in> rf_sr}
 2. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> \<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace>
 3. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>hwASIDTable nextASID x rv' s. \<lbrakk>fst rv' = word_of_nat (Suc (unat maxBound) - unat nextASID) + word_of_nat (length (init [minBound .e. nextASID])); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s\<rbrakk> \<Longrightarrow> \<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, hw_asid_'_update (\<lambda>_. armKSNextASID_' (globals sa)) sa) \<in> rf_sr}
 2. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> \<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace>
 3. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 4. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); \<forall>x\<in>Collect ((\<le>) nextASID) \<union> set (init [minBound .e. nextASID]). \<exists>y. hwASIDTable x = Some y; (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> \<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace>
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>hwASIDTable nextASID x rv' s s'. \<lbrakk>case rv' of (i', rv') \<Rightarrow> dc x rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))); (s, s') \<in> rf_sr; nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s; s' \<in> UNIV; \<exists>y. hwASIDTable nextASID = Some y\<rbrakk> \<Longrightarrow> (valid_pde_mappings' and (\<lambda>_. the (hwASIDTable nextASID) \<le> mask local.asid_bits) and (\<lambda>a. 0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID \<and> UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100 \<and> nextASID = armKSNextASID (ksArchState a)) and K (0 \<le>s UCAST(8 \<rightarrow> 32 signed) nextASID) and K (UCAST(8 \<rightarrow> 32 signed) nextASID <s 0x100)) s \<and> s' \<in> \<lbrace>True \<and> \<acute>armKSHWASIDTable.[unat \<acute>armKSNextASID] = the (hwASIDTable \<acute>armKSNextASID) \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> \<acute>armKSNextASID = \<acute>armKSNextASID \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True \<and> True)) \<and> \<acute>armKSNextASID = nextASID\<rbrace>
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>s s' y. \<lbrakk>(s, s') \<in> rf_sr; armKSHWASIDTable (ksArchState s) (armKSNextASID (ksArchState s)) = Some y; valid_asid_table' (armKSASIDTable (ksArchState s)) s; page_directory_at' (armKSGlobalPD (ksArchState s)) s; valid_global_pts' (armKSGlobalPTs (ksArchState s)) s; is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)); inj_on (map_option snd \<circ> armKSASIDMap (ksArchState s)) (dom (armKSASIDMap (ksArchState s))); dom (armKSASIDMap (ksArchState s)) \<subseteq> {0..mask local.asid_bits} - {0}; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> y \<le> mask local.asid_bits
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>s s' y b. \<lbrakk>(s, s') \<in> rf_sr; armKSHWASIDTable (ksArchState s) (armKSNextASID (ksArchState s)) = Some y; valid_asid_table' (armKSASIDTable (ksArchState s)) s; page_directory_at' (armKSGlobalPD (ksArchState s)) s; valid_global_pts' (armKSGlobalPTs (ksArchState s)) s; is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)); inj_on (map_option snd \<circ> armKSASIDMap (ksArchState s)) (dom (armKSASIDMap (ksArchState s))); dom (armKSASIDMap (ksArchState s)) \<subseteq> {0..mask local.asid_bits} - {0}; valid_pde_mappings' s; armKSASIDMap (ksArchState s) y = Some (armKSNextASID (ksArchState s), b)\<rbrakk> \<Longrightarrow> y \<le> mask local.asid_bits
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>s s' y b. \<lbrakk>(s, s') \<in> rf_sr; armKSHWASIDTable (ksArchState s) (armKSNextASID (ksArchState s)) = Some y; valid_asid_table' (armKSASIDTable (ksArchState s)) s; page_directory_at' (armKSGlobalPD (ksArchState s)) s; valid_global_pts' (armKSGlobalPTs (ksArchState s)) s; is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)); inj_on (map_option snd \<circ> armKSASIDMap (ksArchState s)) (dom (armKSASIDMap (ksArchState s))); valid_pde_mappings' s; armKSASIDMap (ksArchState s) y = Some (armKSNextASID (ksArchState s), b); y \<in> {0..mask local.asid_bits} - {0}\<rbrakk> \<Longrightarrow> y \<le> mask local.asid_bits
 2. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 3. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> sequenceE (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID])) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 2. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>hwASIDTable nextASID. \<lbrace>?R562 hwASIDTable nextASID\<rbrace> mapME (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, -
 2. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and ?R562 rv rva) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>hwASIDTable nextASID x. x \<in> set ([nextASID .e. maxBound] @ init [minBound .e. nextASID]) \<Longrightarrow> \<lbrace>\<lambda>s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace> if hwASIDTable x = None then throwError x else returnOk () \<lbrace>\<lambda>x s. nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and (\<lambda>s. rva = armKSNextASID (ksArchState s) \<and> rv = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s)) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>hwASIDTable nextASID x s. \<lbrakk>x \<in> set ([nextASID .e. maxBound] @ init [minBound .e. nextASID]); nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s\<rbrakk> \<Longrightarrow> True \<and> (hwASIDTable x = None \<longrightarrow> True) \<and> (hwASIDTable x \<noteq> None \<longrightarrow> nextASID = armKSNextASID (ksArchState s) \<and> hwASIDTable = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s)
 2. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and (\<lambda>s. rva = armKSNextASID (ksArchState s) \<and> rv = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s)) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>hwASIDTable nextASID. guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (0 + length (map (\<lambda>x. if hwASIDTable x = None then throwError x else returnOk ()) ([nextASID .e. maxBound] @ init [minBound .e. nextASID]))))) (\<lambda>a. (hw_asid_offset_' a, xfdc a)) (\<lambda>v a. UNIV)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and (\<lambda>s. rva = armKSNextASID (ksArchState s) \<and> rv = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s)) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (valid_arch_state' and valid_pde_mappings') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSHWASIDTable (ksArchState s) = rv \<longrightarrow> (\<forall>rva. armKSNextASID (ksArchState s) = rva \<longrightarrow> ((\<lambda>s. rv = armKSHWASIDTable (ksArchState s) \<and> rva = armKSNextASID (ksArchState s) \<and> valid_arch_state' s) and (\<lambda>s. rva = armKSNextASID (ksArchState s) \<and> rv = armKSHWASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> valid_pde_mappings' s)) s)) \<and> s' \<in> {s. hw_asid_offset_'_update (\<lambda>_. 0) s \<in> {s. \<forall>rv. s \<in> {s. \<forall>rv. s \<in> UNIV \<inter> {s. hw_asid_offset_' s = word_of_nat 0 \<and> dc [] (xfdc s)} \<inter> UNIV}}} proof (prove)
goal:
No subgoals!