theory Finalise_C

lemma deleteASID_ccorres:
  "ccorres dc xfdc (invs' and K (asid < 2 ^ 17) and K (pdPtr \<noteq> 0))
      (UNIV \<inter> {s. asid_' s = asid} \<inter> {s. pd_' s = Ptr pdPtr}) []
      (deleteASID asid pdPtr) (Call deleteASID_'proc)" apply (cinit lift: asid_' pd_' cong: call_ignore_cong) apply (rule ccorres_Guard_Seq)+ apply (rule_tac r'="\<lambda>rv rv'. case rv (ucast (asid_high_bits_of asid)) of
                                None \<Rightarrow> rv' = NULL
                              | Some v \<Rightarrow> rv' = Ptr v \<and> rv' \<noteq> NULL"
               and xf'="poolPtr_'" in ccorres_split_nothrow) apply (rule_tac P="invs' and K (asid < 2 ^ 17)"
                   and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: simpler_gets_def Let_def) apply (erule(1) getKSASIDTable_ccorres_stuff) apply (simp add: asid_high_bits_of_def
                         asidLowBits_def Kernel_C.asidLowBits_def
                         asid_low_bits_def unat_ucast) apply (rule sym, rule Divides.mod_less, simp) apply (rule unat_less_power[where sz=7, simplified]) apply (simp add: word_bits_conv) apply (rule shiftr_less_t2n[where m=7, simplified]) apply simp apply (rule order_less_le_trans, rule ucast_less) apply simp apply (simp add: asid_high_bits_def) apply ceqv apply csymbr apply wpc apply (simp add: ccorres_cond_iffs Collect_False
                  del: Collect_const
                 cong: call_ignore_cong) apply (rule ccorres_cond_false) apply (rule ccorres_return_Skip) apply (simp add: when_def Collect_True liftM_def
                cong: conj_cong call_ignore_cong
                 del: Collect_const) apply (rule ccorres_pre_getObject_asidpool) apply (rule ccorres_Guard_Seq[where F=ArrayBounds]) apply (rule ccorres_move_c_guard_ap) apply (rule ccorres_Guard_Seq)+ apply (rename_tac pool) apply (rule_tac xf'=ret__int_'
                 and val="from_bool (inv ASIDPool pool (asid && mask asid_low_bits)
                                            = Some pdPtr)"
                   and R="ko_at' pool x2 and K (pdPtr \<noteq> 0)"
                in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (clarsimp dest!: rf_sr_cpspace_asidpool_relation) apply (erule(1) cmap_relation_ko_atE) apply (clarsimp simp: typ_heap_simps casid_pool_relation_def
                              array_relation_def
                       split: asidpool.split_asm asid_pool_C.split_asm) apply (drule_tac x="asid && mask asid_low_bits" in spec) apply (simp add: asid_low_bits_def Kernel_C.asidLowBits_def
                         mask_def word_and_le1) apply (drule sym, simp) apply (simp add: option_to_ptr_def option_to_0_def inv_ASIDPool
                  split: option.split if_split bool.split) apply ceqv apply (rule ccorres_cond2[where R=\<top>]) apply (simp add: Collect_const_mem from_bool_0) apply (rule ccorres_rhs_assoc)+ apply (ctac (no_vcg) add: flushSpace_ccorres) apply (ctac (no_vcg) add: invalidateASIDEntry_ccorres) apply (rule ccorres_Guard_Seq[where F=ArrayBounds]) apply (rule ccorres_move_c_guard_ap) apply (rule ccorres_Guard_Seq)+ apply (rule ccorres_split_nothrow_novcg_dc) apply (rule_tac P="ko_at' pool x2" in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule cmap_relationE1[OF rf_sr_cpspace_asidpool_relation],
                   assumption, erule ko_at_projectKO_opt) apply (rule bexI [OF _ setObject_eq],
                   simp_all add: objBits_simps archObjSize_def pageBits_def)[1] apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def typ_heap_simps) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def typ_heap_simps'
                                   update_asidpool_map_tos
                                   update_asidpool_map_to_asidpools) apply (rule cmap_relation_updI, simp_all)[1] apply (simp add: casid_pool_relation_def fun_upd_def[symmetric]
                              inv_ASIDPool
                       split: asidpool.split_asm asid_pool_C.split_asm) apply (erule array_relation_update) subgoal by (simp add: mask_def) subgoal by (simp add: option_to_ptr_def option_to_0_def) subgoal by (simp add: asid_low_bits_def) subgoal by (simp add: carch_state_relation_def cmachine_state_relation_def
                             carch_globals_def update_asidpool_map_tos
                             typ_heap_simps') apply (rule ccorres_pre_getCurThread) apply (ctac add: setVMRoot_ccorres) apply (simp add: cur_tcb'_def[symmetric]) apply (strengthen invs'_invs_no_cicd') apply wp apply (clarsimp simp: rf_sr_def guard_is_UNIV_def
                               cstate_relation_def Let_def) apply wp[1] apply (simp add: fun_upd_def[symmetric]) apply wp apply (rule ccorres_return_Skip) subgoal by (clarsimp simp: guard_is_UNIV_def Collect_const_mem
                           word_sle_def word_sless_def
                           Kernel_C.asidLowBits_def
                           asid_low_bits_def order_le_less_trans [OF word_and_le1]) apply wp apply vcg apply (clarsimp simp: word_sless_def word_sle_def
                        Kernel_C.asidLowBits_def
                        typ_at_to_obj_at_arches) apply (rule conjI) apply (clarsimp simp: mask_def inv_ASIDPool
                  split: asidpool.split) apply (frule obj_at_valid_objs', clarsimp+) apply (clarsimp simp: asid_bits_def typ_at_to_obj_at_arches
                         obj_at'_weakenE[OF _ TrueI]
                         fun_upd_def[symmetric] valid_obj'_def
                         projectKOs invs_valid_pde_mappings'
                         invs_cur') apply (rule conjI, blast) subgoal by (fastforce simp: inv_into_def ran_def  split: if_split_asm) by (clarsimp simp: order_le_less_trans [OF word_and_le1]
                        asid_shiftr_low_bits_less asid_bits_def mask_def
                        plus_one_helper arg_cong[where f="\<lambda>x. 2 ^ x", OF meta_eq_to_obj_eq, OF asid_low_bits_def]
                 split: option.split_asm)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and K (asid < 2 ^ 17) and K (pdPtr \<noteq> 0)) (UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pdPtr\<rbrace>) [] (deleteASID asid pdPtr) (Call deleteASID_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q535 pd asida) (?Q'535 pd asida) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od
od) (Guard ArrayBounds \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)])));;
(\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)))
 2. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q535 pd asida s \<and> s' \<in> ?Q'535 pd asida proof (prove)
goal (2 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q535 pd asida) (?C'545 pd asida) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od
od) (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)];;
(\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)))
 2. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q535 pd asida s \<and> s' \<in> ?C'545 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL) poolPtr_' (?P547 pd asida) (?P'547 pd asida) [SKIP] (gets (armKSASIDTable \<circ> ksArchState)) (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)])
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P547 pd asida and ?R547 pd asida) s \<and> s' \<in> ?P'547 pd asida \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and K (asid < 2 ^ 17)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<exists>(rv, \<sigma>')\<in>fst (gets (armKSASIDTable \<circ> ksArchState) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL)}
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida \<sigma>. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> {s. (invs' and K (asid < 2 ^ 17)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (gets (\<lambda>x. armKSASIDTable (ksArchState x)) \<sigma>). (\<sigma>', poolPtr_'_update (\<lambda>_. armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)]) s) \<in> rf_sr \<and> (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] \<noteq> NULL)}
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> case armKSASIDTable (ksArchState \<sigma>) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] \<noteq> NULL
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> unat (asid >> local.asid_low_bits) = unat (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> unat (asid >> 10) = unat (asid >> 10) mod 128
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> unat (asid >> 10) < 128
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> 7 < LENGTH(32)
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> asid >> 10 < 0x80
 3. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 4. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 5. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> asid >> 10 < 0x80
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> asid < 2 ^ (10 + 7)
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid) < 2 ^ local.asid_high_bits
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> LENGTH(7) < LENGTH(32)
 2. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> 2 ^ LENGTH(7) \<le> 2 ^ local.asid_high_bits
 3. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 4. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid < 0x20000; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> 2 ^ LENGTH(7) \<le> 2 ^ local.asid_high_bits
 2. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 3. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>poolPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)) (?d'547 pd asida rv')
 2. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (?d'547 pd asida rv')
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?Q'547 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (\<acute>ret__int :== (if rv' \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI))
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> ?Q'547 pd asida rv (poolPtr_' s)}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q547 pd asida rv) (?G'802 pd asida rv rv') [SKIP] (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> return () | Some poolPtr \<Rightarrow> do pool <- liftM (inv asidpool.ASIDPool) $ getObject poolPtr;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject poolPtr $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q547 pd asida\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> ?G'802 pd asida rv (poolPtr_' s)}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R905 pd asida rv) (?R''907 pd asida rv rv') [SKIP] (return ()) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida rv rv' x2. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R906 pd asida rv x2) (?R''908 pd asida rv rv' x2) [SKIP] (do pool <- liftM (inv asidpool.ASIDPool) $ getObject x2;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject x2 $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> ?R905 pd asida rv s) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> ?R906 pd asida rv x s)\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> sa \<in> ?R''907 pd asida rv (poolPtr_' s)} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> ?R''908 pd asida rv (poolPtr_' s) x}}}}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; rv' = NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R905 (pde_Ptr pdPtr) asid rv) (?R''907 (pde_Ptr pdPtr) asid rv NULL) [SKIP] (return ()) (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(NULL\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(NULL\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida rv rv' x2. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R906 pd asida rv x2) (?R''908 pd asida rv rv' x2) [SKIP] (do pool <- liftM (inv asidpool.ASIDPool) $ getObject x2;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject x2 $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> ?R905 pd asida rv s) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> ?R906 pd asida rv x s)\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> sa \<in> ?R''907 pd asida rv (poolPtr_' s)} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> ?R''908 pd asida rv (poolPtr_' s) x}}}}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; rv' = NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R905 (pde_Ptr pdPtr) asid rv) (?R'925 (pde_Ptr pdPtr) asid rv NULL) [SKIP] (return ()) SKIP
 2. \<And>pd asida rv rv' x2. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R906 pd asida rv x2) (?R''908 pd asida rv rv' x2) [SKIP] (do pool <- liftM (inv asidpool.ASIDPool) $ getObject x2;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject x2 $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> ?R905 pd asida rv s) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> ?R906 pd asida rv x s)\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> sa \<in> ?R'925 pd asida rv (poolPtr_' s) \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> ?R''908 pd asida rv (poolPtr_' s) x}}}}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv rv' x2. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> rv' = NULL | Some v \<Rightarrow> rv' = ap_Ptr v \<and> rv' \<noteq> NULL; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R906 pd asida rv x2) (?R''908 pd asida rv rv' x2) [SKIP] (do pool <- liftM (inv asidpool.ASIDPool) $ getObject x2;
when (pool (asid && mask local.asidLowBits) = Just pdPtr) $ do flushSpace asid;
invalidateASIDEntry asid;
pool' <- return (pool aLU [(asid && mask local.asidLowBits, Nothing)]);
setObject x2 $ asidpool.ASIDPool pool';
getCurThread >>= setVMRoot
od
od) (IF (if rv' \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)] = pd then 1 else 0)))))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> ?R906 pd asida rv x s)\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> ?R''908 pd asida rv (poolPtr_' s) x}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R906 (pde_Ptr pdPtr) asid rv x2) (?R''908 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2) [SKIP] (do x <- getObject x2;
if inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool x)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()
od) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0)))));;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> ?R906 pd asida rv x s)\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> ?R''908 pd asida rv (poolPtr_' s) x}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 x. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P934 (pde_Ptr pdPtr) asid rv x2 a x) (?P'935 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2 x) [SKIP] (if inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool x)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0)))));;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ?P934 pd asida rv x s asidpool))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?P'935 pd asida rv (poolPtr_' s) x asidpool}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 x. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P942 (pde_Ptr pdPtr) asid rv x2 x) (?C'940 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2 x) [SKIP] (if inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool x)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0))));;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ?P942 pd asida rv x asidpool s))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'940 pd asida rv (poolPtr_' s) x asidpool \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 x. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A949 (pde_Ptr pdPtr) asid rv x2 x) (?C'946 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2 x) [SKIP] (if inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool x)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?A949 pd asida rv x asidpool and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'946 pd asida rv (poolPtr_' s) x asidpool \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 x. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A949 (pde_Ptr pdPtr) asid rv x2 x) (?C'958 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2 x) [SKIP] (if inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool x)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?A949 pd asida rv x asidpool and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'958 pd asida rv (poolPtr_' s) x asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A949 (pde_Ptr pdPtr) asid rv x2 pool) (?C'958 (pde_Ptr pdPtr) asid rv (ap_Ptr x2) x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?A949 pd asida rv x asidpool and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'958 pd asida rv (poolPtr_' s) x asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>pd asida rv x2 pool s. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (ko_at' pool x2 and K (pdPtr \<noteq> 0)) s \<and> (s, s') \<in> rf_sr}) \<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)\<rbrace>)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 pool s x. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 s; pdPtr \<noteq> 0; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 pool s x. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 s; pdPtr \<noteq> 0; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift x) ap_Ptr casid_pool_relation\<rbrakk> \<Longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 pool s x ko'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 s; pdPtr \<noteq> 0; cslift x (ap_Ptr x2) = Some ko'; casid_pool_relation pool ko'\<rbrakk> \<Longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 s x xa xb. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 s; pdPtr \<noteq> 0; cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); \<forall>i\<le>2 ^ local.asid_low_bits - 1. option_to_ptr (xa i) = xb.[unat i]\<rbrakk> \<Longrightarrow> (if xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool (asidpool.ASIDPool xa) (asid && mask local.asid_low_bits) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 s x xa xb. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 s; pdPtr \<noteq> 0; cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); asid && mask local.asid_low_bits \<le> 2 ^ local.asid_low_bits - 1 \<longrightarrow> option_to_ptr (xa (asid && mask local.asid_low_bits)) = xb.[unat (asid && mask local.asid_low_bits)]\<rbrakk> \<Longrightarrow> (if xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool (asidpool.ASIDPool xa) (asid && mask local.asid_low_bits) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 s x xa xb. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 s; pdPtr \<noteq> 0; cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); option_to_ptr (xa (asid && 0x3FF)) = xb.[unat (asid && 0x3FF)]\<rbrakk> \<Longrightarrow> (if xb.[unat (asid && 0x3FF)] = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool (asidpool.ASIDPool xa) (asid && 0x3FF) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv x2 s x xa xb. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 s; pdPtr \<noteq> 0; cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); xb.[unat (asid && 0x3FF)] = option_to_ptr (xa (asid && 0x3FF))\<rbrakk> \<Longrightarrow> (if option_to_ptr (xa (asid && 0x3FF)) = pde_Ptr pdPtr then 1 else 0) = from_bool (inv asidpool.ASIDPool (asidpool.ASIDPool xa) (asid && 0x3FF) = Some pdPtr)
 2. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida rv x2 pool rv' t t'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI) (?y'962 pd asida rv x2 pool rv')
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (?y'962 pd asida rv x2 pool (from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)))
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P965 (pde_Ptr pdPtr) asid rv x2 pool) (?Q962 pd asida rv x2 pool) [SKIP] (if inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr then do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od else return ()) (IF from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0 THEN
  CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. ?Q962 pd asida rv x2 pool)
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (?P965 pd asida rv x asidpool and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) = (s' \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace>)
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1167 (pde_Ptr pdPtr) asid rv x2 pool) (?Rt1158 pd asida rv x2 pool) [SKIP] (do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt1158 pd asida rv x2 pool) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> ?Pt1167 pd asida rv x asidpool s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1167 (pde_Ptr pdPtr) asid rv x2 pool) (?Rt1158 pd asida rv x2 pool) [SKIP] (do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (CALL flushSpace_'proc(asida);;
CALL invalidateASIDEntry_'proc(asida);;
Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt1158 pd asida rv x2 pool) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> ?Pt1167 pd asida rv x asidpool s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1167 (pde_Ptr pdPtr) asid rv x2 pool) (?Rt1158 pd asida rv x2 pool) [SKIP] (do y <- flushSpace asid;
y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (CALL flushSpace_'proc(asida);;
(CALL invalidateASIDEntry_'proc(asida);;
(Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))))
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt1158 pd asida rv x2 pool) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> ?Pt1167 pd asida rv x asidpool s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1181 pd asida rv x2 pool rva) (?Q'1181 pd asida rv x2 pool rva xfdca) [SKIP] (do y <- invalidateASIDEntry asid;
y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (CALL invalidateASIDEntry_'proc(asida);;
(Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread)))
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>?Q1181 pd asida rv x2 pool\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1181 pd asida rv x2 pool rva (xfdc t)}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1215 pd asida rv x2 pool rva xfdca rvb) (?Q'1215 pd asida rv x2 pool rva xfdca rvb xfdcb) [SKIP] (do y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>?Q1215 pd asida rv x2 pool rva xfdc\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'1215 pd asida rv x2 pool rva (xfdc t) rvb (xfdc ta)}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1215 pd asida rv x2 pool rva xfdca rvb) (?C'1243 pd asida rv x2 pool rva xfdca rvb xfdcb) [SKIP] (do y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr x2} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>?Q1215 pd asida rv x2 pool rva xfdc\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?C'1243 pd asida rv x2 pool rva (xfdc t) rvb (xfdc ta) \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1246 pd asida rv x2 pool rva xfdca rvb) (?C'1245 pd asida rv x2 pool rva xfdca rvb xfdcb) [SKIP] (do y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ?A1246 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?C'1245 pd asida rv x2 pool rva (xfdc t) rvb (xfdc ta) \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1246 pd asida rv x2 pool rva xfdca rvb) (?C'1251 pd asida rv x2 pool rva xfdca rvb xfdcb) [SKIP] (do y <- setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)));
getCurThread >>= setVMRoot
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ?A1246 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?C'1251 pd asida rv x2 pool rva (xfdc t) rvb (xfdc ta) \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1254 pd asida rv x2 pool rva xfdca rvb) (?C'1251 pd asida rv x2 pool rva xfdca rvb xfdcb) [] (setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)))) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))))
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ?P1254 pd asida rv x2 pool rva xfdc rvb and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?C'1251 pd asida rv x2 pool rva (xfdc t) rvb (xfdc ta) \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ko_at' pool x2 \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) {s. \<exists>(rv, \<sigma>')\<in>fst (setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb \<sigma>. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> {s. ko_at' pool x2 \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<sigma>). (\<sigma>', globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))) s))}
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv x2 pool \<sigma> x. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))) x) \<in> rf_sr
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))) x) \<in> rf_sr
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)))))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)))) x) \<in> rf_sr
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)))))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)))))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)) (t_hrs_' (globals x)))
 2. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 6. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_asidpools (ksPSpace \<sigma>))(x2 \<mapsto> asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)))) ((cslift x)(ap_Ptr x2 \<mapsto> array_C_update (\<lambda>_. Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL) y')) ap_Ptr casid_pool_relation
 2. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 6. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> casid_pool_relation (asidpool.ASIDPool (\<lambda>a. if a = asid && mask local.asid_low_bits then None else inv asidpool.ASIDPool pool a)) (array_C_update (\<lambda>_. Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL) y')
 2. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 6. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb; array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) xa xb\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) (xa(asid && mask local.asid_low_bits := None)) (Arrays.update xb (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL)
 2. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 6. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> unat (asid && 2 ^ local.asid_low_bits - 1) = unat (asid && mask local.asid_low_bits)
 2. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 3. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024)
 4. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 6. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 7. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 8. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 10. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cslift x_ (ap_Ptr x2_) = Some (asid_pool_C.asid_pool_C xb_); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; x2_ \<noteq> 0; rv_ (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2_; ko_at' (asidpool.ASIDPool xa_) x2_ \<sigma>_; map_to_asidpools (ksPSpace \<sigma>_) x2_ = Some (asidpool.ASIDPool xa_); pool_ = asidpool.ASIDPool xa_; y'_ = asid_pool_C.asid_pool_C xb_\<rbrakk> \<Longrightarrow> unat (asid && 2 ^ local.asid_low_bits - 1) = unat (asid && mask local.asid_low_bits) proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 2. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024)
 3. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 6. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 7. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 10. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cslift x_ (ap_Ptr x2_) = Some (asid_pool_C.asid_pool_C xb_); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; x2_ \<noteq> 0; rv_ (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2_; ko_at' (asidpool.ASIDPool xa_) x2_ \<sigma>_; map_to_asidpools (ksPSpace \<sigma>_) x2_ = Some (asidpool.ASIDPool xa_); pool_ = asidpool.ASIDPool xa_; y'_ = asid_pool_C.asid_pool_C xb_\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 pool \<sigma> x y' xa xb. \<lbrakk>cslift x (ap_Ptr x2) = Some (asid_pool_C.asid_pool_C xb); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' (asidpool.ASIDPool xa) x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some (asidpool.ASIDPool xa); pool = asidpool.ASIDPool xa; y' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024)
 2. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 5. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 6. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 9. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cslift x_ (ap_Ptr x2_) = Some (asid_pool_C.asid_pool_C xb_); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; x2_ \<noteq> 0; rv_ (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2_; ko_at' (asidpool.ASIDPool xa_) x2_ \<sigma>_; map_to_asidpools (ksPSpace \<sigma>_) x2_ = Some (asidpool.ASIDPool xa_); pool_ = asidpool.ASIDPool xa_; y'_ = asid_pool_C.asid_pool_C xb_\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (11 subgoals):
 1. \<And>rv x2 pool \<sigma> x y'. \<lbrakk>x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; ko_at' pool x2 \<sigma>; map_to_asidpools (ksPSpace \<sigma>) x2 = Some pool; casid_pool_relation pool y'; cslift x (ap_Ptr x2) = Some y'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2\<rightarrow>[''array_C''])) (Arrays.update (array_C y') (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(x2 \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 4. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 5. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 8. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 10. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x2_ \<noteq> 0; rv_ (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2_; ko_at' pool_ x2_ \<sigma>_; map_to_asidpools (ksPSpace \<sigma>_) x2_ = Some pool_; casid_pool_relation pool_ y'_; cslift x_ (ap_Ptr x2_) = Some y'_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>_) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2_\<rightarrow>[''array_C''])) (Arrays.update (array_C y'_) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x_)) \<and> cmachine_state_relation (ksMachineState \<sigma>_) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr x2_\<rightarrow>[''array_C''])) (Arrays.update (array_C y'_) (unat (asid && 2 ^ local.asid_low_bits - 1)) NULL))) (globals x_)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>_)(x2_ \<mapsto> KOArch (KOASIDPool (asidpool.ASIDPool ((inv asidpool.ASIDPool pool_)(asid && mask local.asid_low_bits := None))))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))) proof (prove)
goal (10 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1253 pd asida rv x2 pool rva xfdca rvb xfdcb y) (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb y rv') [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>?Q1253 pd asida rv x2 pool rva xfdca rvb xfdc\<rbrace>
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1253 pd asida rv x2 pool rva xfdca rvb xfdcb)
 4. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 8. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 10. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb y rv' rvc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1371 pd asida rv x2 pool rva xfdca rvb xfdcb y rvc) (?P'1370 pd asida rv x2 pool rva xfdca rvb xfdcb y rv' rvc) [SKIP] (setVMRoot rvc) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>\<lambda>y s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ?P1371 pd asida rv x2 pool rva xfdca rvb xfdc y rvc s\<rbrace>
 3. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> ?P'1370 pd asida rv x2 pool rva xfdca rvb xfdcb y rv' rvc})
 4. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 7. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 8. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 9. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 10. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 pd asida rv x2 pool rva xfdca rvb\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' rv) s\<rbrace>
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 3. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 8. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 9. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>pd asida rv x2 pool xfdca. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 (pde_Ptr pdPtr) asid rv x2 pool () xfdca ()\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>\<lambda>y s. all_invs_but_ct_idle_or_in_cur_domain' s \<and> cur_tcb' s\<rbrace>
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 3. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 8. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 9. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>pd asida rv x2 pool xfdca. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1255 (pde_Ptr pdPtr) asid rv x2 pool () xfdca ()\<rbrace> setObject x2 (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None))) \<lbrace>\<lambda>r s. invs' s \<and> cur_tcb' s\<rbrace>
 2. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 3. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and ?R1255 pd asida rv x2 pool rva xfdc rvb and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 6. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 8. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 9. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdca rvb xfdcb. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 2. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and (\<lambda>a. (invs' and valid_asid_pool' (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asida && mask local.asid_low_bits := None)))) a \<and> cur_tcb' a) and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 5. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 7. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 8. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>pd asida rv x2 pool rva xfdc. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1217 pd asida rv x2 pool rva\<rbrace> invalidateASIDEntry asid \<lbrace>\<lambda>rvb. ko_at' pool x2 and (\<lambda>a. (invs' and valid_asid_pool' (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asida && mask local.asid_low_bits := None)))) a \<and> cur_tcb' a) and asid_pool_at' (ptr_val (ap_Ptr x2))\<rbrace>
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and ?R1217 pd asida rv x2 pool a\<rbrace>
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 4. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 6. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 7. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a. (\<lambda>s. valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits) and (\<lambda>s. ko_at' pool x2 s \<and> invs' s \<and> valid_asid_pool' (asidpool.ASIDPool ((inv asidpool.ASIDPool pool)(asida && mask local.asid_low_bits := None))) s \<and> cur_tcb' s \<and> asid_pool_at' (ptr_val (ap_Ptr x2)) s)\<rbrace>
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R1185 (pde_Ptr pdPtr) asid rv x2 pool\<rbrace> flushSpace asid \<lbrace>\<lambda>a b. valid_pde_mappings' b \<and> asid \<le> mask local.asid_bits \<and> ko_at' pool x2 b \<and> invs' b \<and> dom (inv asidpool.ASIDPool pool) - {asid && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool pool)(asid && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' b \<and> asid_pool_at' x2 b\<rbrace>
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 3. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R1185 pd asida rv x asidpool) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 5. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 6. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1165 (pde_Ptr pdPtr) asid rv x2 pool) (?Rf1158 pd asida rv x2 pool) [SKIP] (return ()) SKIP
 2. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rva rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf1158 pd asida rv x2 pool)})
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. valid_pde_mappings' a \<and> asida \<le> mask local.asid_bits \<and> ko_at' asidpool x a \<and> invs' a \<and> dom (inv asidpool.ASIDPool asidpool) - {asida && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' a \<and> asid_pool_at' x a)) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> ?Pf1165 pd asida rv x asidpool s) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 4. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 5. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pd asida rv x2 pool. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; x2 \<noteq> 0; rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rv rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. valid_pde_mappings' a \<and> asida \<le> mask local.asid_bits \<and> ko_at' asidpool x a \<and> invs' a \<and> dom (inv asidpool.ASIDPool asidpool) - {asida && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' a \<and> asid_pool_at' x a)) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> True) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 3. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 4. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pd_ = pde_Ptr pdPtr; asida_ = asid; x2_ \<noteq> 0; rv_ (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x2_\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (inv asidpool.ASIDPool pool_ (asid && mask local.asid_low_bits) = Some pdPtr)) ret__int_' (\<lambda>rv rv'. {s. (s \<in> \<lbrace>from_bool (inv asidpool.ASIDPool pool_ (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asida_) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. asid_'_update (\<lambda>_. asida_) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}) \<and> (s \<notin> \<lbrace>from_bool (inv asidpool.ASIDPool pool_ (asid && mask local.asid_low_bits) = Some pdPtr) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)}) proof (prove)
goal (3 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<lbrace>?R547 pd asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv s. (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. valid_pde_mappings' a \<and> asida \<le> mask local.asid_bits \<and> ko_at' asidpool x a \<and> invs' a \<and> dom (inv asidpool.ASIDPool asidpool) - {asida && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' a \<and> asid_pool_at' x a)) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> True) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s))\<rbrace>
 2. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 3. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and ?R547 pd asida) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>pd asida. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F547 pd asida\<^esub> (?R'547 pd asida) \<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)] {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> poolPtr_' s = NULL | Some v \<Rightarrow> poolPtr_' s = ap_Ptr v \<and> poolPtr_' s \<noteq> NULL) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if poolPtr_' s \<noteq> NULL then 1 else 0\<rparr> \<in> {s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {sa. \<forall>x. sa \<in> {sa. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (poolPtr_' s) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>}}}}}
 2. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and (\<lambda>s. ((armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. (armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. valid_pde_mappings' a \<and> asida \<le> mask local.asid_bits \<and> ko_at' asidpool x a \<and> invs' a \<and> dom (inv asidpool.ASIDPool asidpool) - {asida && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' a \<and> asid_pool_at' x a)) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> True) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s)))) s \<and> s' \<in> UNIV \<inter> ?R'547 pd asida \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>pd asida s s'. \<lbrakk>pd = pde_Ptr pdPtr; asida = asid; (s, s') \<in> rf_sr; (invs' and (\<lambda>y. asid < 0x20000) and (\<lambda>y. pdPtr \<noteq> 0)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and K (asid < 2 ^ 17) and (\<lambda>s. ((armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True) \<and> (\<forall>x. (armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. valid_pde_mappings' a \<and> asida \<le> mask local.asid_bits \<and> ko_at' asidpool x a \<and> invs' a \<and> dom (inv asidpool.ASIDPool asidpool) - {asida && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool asidpool)(asida && mask local.asid_low_bits := None)). is_aligned x pdBits) \<and> cur_tcb' a \<and> asid_pool_at' x a)) s) and (\<lambda>s. inv asidpool.ASIDPool asidpool (asida && mask local.asid_low_bits) \<noteq> Some pdPtr \<longrightarrow> True) and (ko_at' asidpool x and K (pdPtr \<noteq> 0)) and asid_pool_at' (ptr_val (ap_Ptr x))) s)))) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> True \<and> \<not> (if armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] \<noteq> NULL then 1 else 0) \<noteq> 0) \<and> (\<forall>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool asidpool'. cslift s (armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> True \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> True \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>x. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (inv asidpool.ASIDPool asidpool (asid && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> dom (inv asidpool.ASIDPool asidpool) - {asid && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran (\<lambda>a. if a = asid && mask local.asid_low_bits then None else inv asidpool.ASIDPool asidpool a) \<and> (\<forall>x\<in>ran (\<lambda>a. if a = asid && mask local.asid_low_bits then None else inv asidpool.ASIDPool asidpool a). is_aligned x pdBits) \<and> cur_tcb' s \<and> obj_at' (\<lambda>_. True) x s) \<and> obj_at' (\<lambda>_. True) x s)) \<and> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>x. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x \<longrightarrow> (\<forall>asidpool. ko_at' asidpool x s \<longrightarrow> (inv asidpool.ASIDPool asidpool (asid && mask local.asid_low_bits) = Some pdPtr \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> dom (inv asidpool.ASIDPool asidpool) - {asid && mask local.asid_low_bits} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran (\<lambda>a. if a = asid && mask local.asid_low_bits then None else inv asidpool.ASIDPool asidpool a) \<and> (\<forall>x\<in>ran (\<lambda>a. if a = asid && mask local.asid_low_bits then None else inv asidpool.ASIDPool asidpool a). is_aligned x pdBits) \<and> cur_tcb' s \<and> obj_at' (\<lambda>_. True) x s) \<and> obj_at' (\<lambda>_. True) x s)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>s s' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x; ko_at' (asidpool.ASIDPool xa) x s\<rbrakk> \<Longrightarrow> (xa (asid && 2 ^ local.asid_low_bits - 1) = Some pdPtr \<longrightarrow> valid_pde_mappings' s \<and> asid < 2 ^ local.asid_bits \<and> valid_pde_mappings' s \<and> asid < 2 ^ local.asid_bits \<and> dom xa - {asid && 2 ^ local.asid_low_bits - 1} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran (\<lambda>a. if a = asid && 2 ^ local.asid_low_bits - 1 then None else inv asidpool.ASIDPool (asidpool.ASIDPool xa) a) \<and> (\<forall>x\<in>ran (\<lambda>a. if a = asid && 2 ^ local.asid_low_bits - 1 then None else inv asidpool.ASIDPool (asidpool.ASIDPool xa) a). is_aligned x pdBits) \<and> cur_tcb' s \<and> obj_at' (\<lambda>_. True) x s) \<and> obj_at' (\<lambda>_. True) x s
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>s s' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x; ko_at' (asidpool.ASIDPool xa) x s; (\<forall>ko. projectKO_opt ko = Some (asidpool.ASIDPool xa) \<longrightarrow> KOArch (KOASIDPool (asidpool.ASIDPool xa)) = ko) \<longrightarrow> valid_obj' (KOArch (KOASIDPool (asidpool.ASIDPool xa))) s\<rbrakk> \<Longrightarrow> (xa (asid && 2 ^ local.asid_low_bits - 1) = Some pdPtr \<longrightarrow> valid_pde_mappings' s \<and> asid < 2 ^ local.asid_bits \<and> valid_pde_mappings' s \<and> asid < 2 ^ local.asid_bits \<and> dom xa - {asid && 2 ^ local.asid_low_bits - 1} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran (\<lambda>a. if a = asid && 2 ^ local.asid_low_bits - 1 then None else inv asidpool.ASIDPool (asidpool.ASIDPool xa) a) \<and> (\<forall>x\<in>ran (\<lambda>a. if a = asid && 2 ^ local.asid_low_bits - 1 then None else inv asidpool.ASIDPool (asidpool.ASIDPool xa) a). is_aligned x pdBits) \<and> cur_tcb' s \<and> obj_at' (\<lambda>_. True) x s) \<and> obj_at' (\<lambda>_. True) x s
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>s s' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x; ko_at' (asidpool.ASIDPool xa) x s; dom xa \<subseteq> {0..2 ^ local.asid_low_bits - 1}; 0 \<notin> ran xa; \<forall>x\<in>ran xa. is_aligned x pdBits; xa (asid && 2 ^ local.asid_low_bits - 1) = Some pdPtr\<rbrakk> \<Longrightarrow> dom xa - {asid && 2 ^ local.asid_low_bits - 1} \<subseteq> {0..2 ^ local.asid_low_bits - 1} \<and> 0 \<notin> ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa))(asid && 2 ^ local.asid_low_bits - 1 := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa))(asid && 2 ^ local.asid_low_bits - 1 := None)). is_aligned x pdBits)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>s s' x xa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x; ko_at' (asidpool.ASIDPool xa) x s; dom xa \<subseteq> {0..2 ^ local.asid_low_bits - 1}; 0 \<notin> ran xa; \<forall>x\<in>ran xa. is_aligned x pdBits; xa (asid && 2 ^ local.asid_low_bits - 1) = Some pdPtr\<rbrakk> \<Longrightarrow> 0 \<notin> ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa))(asid && 2 ^ local.asid_low_bits - 1 := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa))(asid && 2 ^ local.asid_low_bits - 1 := None)). is_aligned x pdBits)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; asid < 0x20000; pdPtr \<noteq> 0; armKSASIDTable (ksArchState s_) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x_; ko_at' (asidpool.ASIDPool xa_) x_ s_; dom xa_ \<subseteq> {0..2 ^ local.asid_low_bits - 1}; 0 \<notin> ran xa_; \<forall>x\<in>ran xa_. is_aligned x pdBits; xa_ (asid && 2 ^ local.asid_low_bits - 1) = Some pdPtr\<rbrakk> \<Longrightarrow> 0 \<notin> ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa_))(asid && 2 ^ local.asid_low_bits - 1 := None)) \<and> (\<forall>x\<in>ran ((inv asidpool.ASIDPool (asidpool.ASIDPool xa_))(asid && 2 ^ local.asid_low_bits - 1 := None)). is_aligned x pdBits) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid < 0x20000; pdPtr \<noteq> 0\<rbrakk> \<Longrightarrow> (\<forall>rv. (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<noteq> NULL) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None \<longrightarrow> armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL) \<and> ((\<exists>x. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some x) \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> s' \<in> (if asid >> local.asid_low_bits < 0x80 then UNIV else {})