theory Finalise_C

lemma deleteASIDPool_ccorres:
  "ccorres dc xfdc (invs' and (\<lambda>_. base < 2 ^ 17 \<and> pool \<noteq> 0))
      (UNIV \<inter> {s. asid_base_' s = base} \<inter> {s. pool_' s = Ptr pool}) []
      (deleteASIDPool base pool) (Call deleteASIDPool_'proc)" apply (rule ccorres_gen_asm) apply (cinit lift: asid_base_' pool_' simp: whileAnno_def) apply (rule ccorres_assert) apply (clarsimp simp: liftM_def fun_upd_def[symmetric] when_def
               simp del: Collect_const) apply (rule ccorres_Guard)+ apply (rule ccorres_pre_gets_armKSASIDTable_ksArchState) apply (rule_tac R="\<lambda>s. rv = armKSASIDTable (ksArchState s)" in ccorres_cond2) apply clarsimp apply (subst rf_sr_armKSASIDTable, assumption) apply (simp add: asid_high_bits_word_bits) apply (rule shiftr_less_t2n) apply (simp add: asid_low_bits_def asid_high_bits_def) apply (subst ucast_asid_high_bits_is_shift) apply (simp add: mask_def, simp add: asid_bits_def) apply (simp add: option_to_ptr_def option_to_0_def split: option.split) apply (rule ccorres_Guard_Seq ccorres_rhs_assoc)+ apply (rule ccorres_pre_getObject_asidpool) apply (rename_tac poolKO) apply (simp only: mapM_discarded) apply (rule ccorres_rhs_assoc2,
           rule ccorres_split_nothrow_novcg) apply (simp add: word_sle_def Kernel_C.asidLowBits_def Collect_True
                    del: Collect_const) apply (rule ccorres_semantic_equivD2[rotated]) apply (simp only: semantic_equiv_def) apply (rule Seq_ceqv [OF ceqv_refl _ xpres_triv]) apply (simp only: ceqv_Guard_UNIV) apply (rule While_ceqv [OF _ _ xpres_triv], rule impI, rule refl) apply (rule ceqv_remove_eqv_skip) apply (simp add: ceqv_Guard_UNIV ceqv_refl) apply (rule_tac F="\<lambda>n. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'"
                    in ccorres_mapM_x_while_gen[OF _ _ _ _ _ offset_xf_for_sequence,
                                                where j=1, simplified]) apply (intro allI impI) apply (rule ccorres_guard_imp2) apply (rule_tac xf'="offset_'" in ccorres_abstract, ceqv) apply (rule_tac P="rv' = of_nat n" in ccorres_gen_asm2) apply (rule ccorres_Guard[where F=ArrayBounds]) apply (rule ccorres_move_c_guard_ap) apply (rule_tac R="ko_at' poolKO pool and valid_objs'" in ccorres_cond2) apply (clarsimp dest!: rf_sr_cpspace_asidpool_relation) apply (erule cmap_relationE1, erule ko_at_projectKO_opt) apply (clarsimp simp: casid_pool_relation_def typ_heap_simps
                                     inv_ASIDPool
                              split: asidpool.split_asm asid_pool_C.split_asm) apply (simp add: upto_enum_word  del: upt.simps) apply (drule(1) ko_at_valid_objs') apply (simp add: projectKOs) apply (clarsimp simp: array_relation_def valid_obj'_def
                                     ran_def) apply (drule_tac x="of_nat n" in spec)+ apply (simp add: asid_low_bits_def word_le_nat_alt) apply (simp add: word_unat.Abs_inverse unats_def) apply (simp add: option_to_ptr_def option_to_0_def split: option.split_asm) apply clarsimp apply (ctac(no_vcg) add: flushSpace_ccorres) apply (ctac add: invalidateASIDEntry_ccorres) apply wp apply (rule ccorres_return_Skip) apply (clarsimp simp: Collect_const_mem) apply (simp add: upto_enum_word  typ_at_to_obj_at_arches
                             obj_at'_weakenE[OF _ TrueI]
                        del: upt.simps) apply (simp add: is_aligned_mask[symmetric]) apply (rule conjI[rotated]) apply (simp add: asid_low_bits_def word_of_nat_less) apply (clarsimp simp: mask_def) apply (erule is_aligned_add_less_t2n) apply (subst(asm) Suc_unat_diff_1) apply (simp add: asid_low_bits_def) apply (simp add: asid_low_bits_word_bits) apply (erule of_nat_less_pow_32 [OF _ asid_low_bits_word_bits]) apply (simp add: asid_low_bits_def asid_bits_def) apply (simp add: asid_bits_def) apply (simp add: upto_enum_word ) apply (vcg exspec=flushSpace_modifies exspec=invalidateASIDEntry_modifies) apply clarsimp apply (rule hoare_pre, wp) apply simp apply (simp add: upto_enum_word  asid_low_bits_def) apply ceqv apply (rule ccorres_move_const_guard)+ apply (rule ccorres_split_nothrow_novcg_dc) apply (rule_tac P="\<lambda>s. rv = armKSASIDTable (ksArchState s)"
                      in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: simpler_modify_def) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                               carch_state_relation_def cmachine_state_relation_def
                               carch_globals_def h_t_valid_clift_Some_iff) apply (erule array_relation_update[unfolded fun_upd_def]) apply (simp add: asid_high_bits_of_def unat_ucast asid_low_bits_def) apply (rule sym, rule nat_mod_eq') apply (rule order_less_le_trans, rule iffD1[OF word_less_nat_alt]) apply (rule shiftr_less_t2n[where m=7]) subgoal by simp subgoal by simp subgoal by (simp add: option_to_ptr_def option_to_0_def) subgoal by (simp add: asid_high_bits_def) apply (rule ccorres_pre_getCurThread) apply (ctac add: setVMRoot_ccorres) apply wp apply (simp add: guard_is_UNIV_def) apply (simp add: pred_conj_def fun_upd_def[symmetric]
                      cur_tcb'_def[symmetric]) apply (strengthen invs'_invs_no_cicd', strengthen invs_asid_update_strg') apply (rule mapM_x_wp') apply (rule hoare_pre, wp) apply simp apply (simp add: guard_is_UNIV_def Kernel_C.asidLowBits_def
                     word_sle_def word_sless_def Collect_const_mem
                     mask_def asid_bits_def plus_one_helper
                     asid_shiftr_low_bits_less) apply (rule ccorres_return_Skip) apply (simp add: Kernel_C.asidLowBits_def
                   word_sle_def word_sless_def) apply (auto simp: asid_shiftr_low_bits_less Collect_const_mem
                    mask_def asid_bits_def plus_one_helper) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and (\<lambda>_. base < 2 ^ 17 \<and> pool \<noteq> 0)) (UNIV \<inter> \<lbrace>\<acute>asid_base = base\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr pool\<rbrace>) [] (deleteASIDPool base pool) (Call deleteASIDPool_'proc) proof (prove)
goal (1 subgoal):
 1. base < 2 ^ 17 \<and> pool \<noteq> 0 \<Longrightarrow> ccorres dc xfdc invs' (UNIV \<inter> \<lbrace>\<acute>asid_base = base\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr pool\<rbrace>) [] (deleteASIDPool base pool) (Call deleteASIDPool_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>poola asid_base. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q851 poola asid_base) (?Q'851 poola asid_base) [SKIP] (do y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) (do pool <- liftM (inv asidpool.ASIDPool) (getObject pool);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od) (Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (IF \<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola THEN
  \<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poola} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poola\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(asid_base + UCAST(32 \<rightarrow> 32) \<acute>offset);;
CALL invalidateASIDEntry_'proc(asid_base + UCAST(32 \<rightarrow> 32) \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI))))
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q851 poola asid_base s \<and> s' \<in> ?Q'851 poola asid_base proof (prove)
goal (2 subgoals):
 1. \<And>poola asid_base. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; base && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q851 poola asid_base) (?Q'851 poola asid_base) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) (do pool <- liftM (inv asidpool.ASIDPool) (getObject pool);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od) (Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (IF \<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola THEN
  \<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poola} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poola\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(asid_base + UCAST(32 \<rightarrow> 32) \<acute>offset);;
CALL invalidateASIDEntry_'proc(asid_base + UCAST(32 \<rightarrow> 32) \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI))))
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q851 poola asid_base s \<and> s' \<in> ?Q'851 poola asid_base proof (prove)
goal (2 subgoals):
 1. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q851 (ap_Ptr pool) base) (?Q'851 (ap_Ptr pool) base) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool then do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od else return ()
od) (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (IF \<acute>armKSASIDTable.[unat (base >> local.asid_low_bits)] = ap_Ptr pool THEN
  \<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI))))
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q851 poola asid_base s \<and> s' \<in> ?Q'851 poola asid_base proof (prove)
goal (2 subgoals):
 1. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q851 (ap_Ptr pool) base) (?C'871 (ap_Ptr pool) base) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool then do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od else return ()
od) (IF \<acute>armKSASIDTable.[unat (base >> local.asid_low_bits)] = ap_Ptr pool THEN
  \<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q851 poola asid_base s \<and> s' \<in> ?C'871 poola asid_base \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P878 (ap_Ptr pool) base a rv) (?P'880 (ap_Ptr pool) base rv) [SKIP] (if rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool then do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od else return ()) (IF \<acute>armKSASIDTable.[unat (base >> local.asid_low_bits)] = ap_Ptr pool THEN
  \<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)
FI)
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ?P878 poola asid_base s rv) \<and> s' \<in> {s. \<forall>rv. s \<in> ?P'880 poola asid_base rv} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> rv = armKSASIDTable (ksArchState s) \<longrightarrow> (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (s' \<in> \<lbrace>\<acute>armKSASIDTable.[unat (base >> local.asid_low_bits)] = ap_Ptr pool\<rbrace>)
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (armKSASIDTable_' (globals s').[unat (base >> local.asid_low_bits)] = ap_Ptr pool)
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> base >> local.asid_low_bits \<le> 2 ^ local.asid_high_bits - 1
 2. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> base >> local.asid_low_bits < 2 ^ local.asid_high_bits
 2. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> base < 2 ^ (local.asid_low_bits + local.asid_high_bits)
 2. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> base \<le> mask local.asid_bits
 2. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits) = Some pool) = (option_to_ptr (armKSASIDTable (ksArchState s) (base >> local.asid_low_bits)) = ap_Ptr pool)
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt898 (ap_Ptr pool) base rv) (?Rt896 (ap_Ptr pool) base rv) [SKIP] (do x <- getObject pool;
y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool x offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
(Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))))
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> ?Pt898 poola asid_base rv s) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rt896 poola asid_base rv) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv rva. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P926 (ap_Ptr pool) base rv a rva) (?P'927 (ap_Ptr pool) base rv rva) [SKIP] (do y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool rva offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
(Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))))
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> ?P926 poola asid_base rv s asidpool)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P926 (ap_Ptr pool) base rv a poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [SKIP] (do y <- mapM (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
(Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))))
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> ?P926 poola asid_base rv s asidpool)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P926 (ap_Ptr pool) base rv a poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [SKIP] (do _ <- mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>offset :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP))));;
(Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))))
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> ?P926 poola asid_base rv s asidpool)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> SKIP)))))
 2. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
Guard ShiftError UNIV (Guard ShiftError UNIV (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))))
 2. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> semantic_equiv \<Gamma> s s' (\<acute>offset :== 0;;
Guard ShiftError UNIV (Guard ShiftError UNIV (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))) (?c1006 rv poolKO)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (?c1006 rv poolKO)
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>_. ()) () s s' (\<acute>offset :== 0;;
Guard ShiftError UNIV (Guard ShiftError UNIV (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))) (?c1006 rv poolKO)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (?c1006 rv poolKO)
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s' t. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>_. ()) () t s' (Guard ShiftError UNIV (Guard ShiftError UNIV (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))) (?b'1013 rv poolKO)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
?b'1013 rv poolKO)
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s' t. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>_. ()) () t s' (While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))) (?b'1013 rv poolKO)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
?b'1013 rv poolKO)
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s' t ta t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>_. ()) () ta t' (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (?a'1020 rv poolKO)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (?a'1020 rv poolKO))
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO s s' t ta t' sa. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; s \<in> ?P'927 (ap_Ptr pool) base rv poolKO\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>_. ()) () sa t' (Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) SKIP
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1))
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'933 rv poolKO) (?xf'933 rv poolKO) (?P939 (ap_Ptr pool) base rv poolKO) (?P'927 (ap_Ptr pool) base rv poolKO) [] (mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1]) (\<acute>offset :== 0;;
While \<lbrace>\<acute>offset < 2 ^ local.asid_low_bits\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI));;
\<acute>offset :== \<acute>offset + 1))
 2. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'933 rv poolKO) rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; ?r'933 rv poolKO rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'933 rv poolKO) (?xf'933 rv poolKO) (?Q'933 rv poolKO)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (?P939 poola asid_base rv asidpool and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> ?P'927 poola asid_base rv asidpool}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>n<length [0 .e. 2 ^ local.asid_low_bits - 1]. ccorres dc xfdc (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') \<lbrace>\<acute>offset = word_of_nat n\<rbrace> [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)))
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') \<lbrace>\<acute>offset = word_of_nat n\<rbrace> [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)))
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1032 rv poolKO n) (?Q'1032 rv poolKO n) [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)))
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1032 rv poolKO n s \<and> s' \<in> ?Q'1032 rv poolKO n
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1032 rv poolKO n) (?G'1035 rv poolKO n rv') [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard ArrayBounds \<lbrace>rv' < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat rv'] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv')
FI)))
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1032 rv poolKO n s \<and> s' \<in> {s. s \<in> ?G'1035 rv poolKO n (offset_' s)}
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1032 rv poolKO n) (?G'1118 rv poolKO n rv') [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard ArrayBounds \<lbrace>rv' < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat rv'] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv')
FI)))
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1032 rv poolKO n s \<and> s' \<in> {s. s \<in> ?G'1118 rv poolKO n (offset_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1032 rv poolKO n) (?C'1119 rv poolKO n rv') [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat rv'] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv')
FI))
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1032 rv poolKO n s \<and> s' \<in> {s. s \<in> ?C'1119 rv poolKO n (offset_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1122 rv poolKO n) (?C'1121 rv poolKO n rv') [] (if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return ()) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat rv'] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv')
FI)
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A1122 rv poolKO n and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> ?C'1121 rv poolKO n (offset_' s) \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> (ko_at' poolKO pool and valid_objs') s \<longrightarrow> (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) = (s' \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat rv'] \<noteq> NULL\<rbrace>)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; ko_at' poolKO pool s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) = (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>poolKO n s s' y'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); ko_at' poolKO pool s; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some poolKO; casid_pool_relation poolKO y'; cslift s' (ap_Ptr pool) = Some y'\<rbrakk> \<Longrightarrow> (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) = (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); ko_at' (asidpool.ASIDPool x) pool s; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) x xa\<rbrakk> \<Longrightarrow> (\<exists>y. x ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); ko_at' (asidpool.ASIDPool x) pool s; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) x xa\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n s s' x xa ko. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) x xa; projectKO_opt ko = Some (asidpool.ASIDPool x)\<rbrakk> \<Longrightarrow> injectKOS (asidpool.ASIDPool x) = ko
 2. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) x xa; valid_obj' (injectKOS (asidpool.ASIDPool x)) s\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 4. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 5. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 8. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 10. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) x xa; valid_obj' (injectKOS (asidpool.ASIDPool x)) s\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); \<forall>i\<le>2 ^ local.asid_low_bits - 1. option_to_ptr (x i) = xa.[unat i]; dom x \<subseteq> {0..2 ^ local.asid_low_bits - 1}; \<forall>a. x a \<noteq> Some 0; \<forall>xa. (\<exists>a. x a = Some xa) \<longrightarrow> is_aligned xa pdBits\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); dom x \<subseteq> {0..2 ^ local.asid_low_bits - 1}; word_of_nat n \<le> 2 ^ local.asid_low_bits - 1 \<longrightarrow> option_to_ptr (x (word_of_nat n)) = xa.[unat (word_of_nat n)]; x (word_of_nat n) \<noteq> Some 0; (\<exists>a. x a = Some (word_of_nat n)) \<longrightarrow> is_aligned (word_of_nat n) pdBits\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; n < 1024; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); dom x \<subseteq> {0..0x3FF}; unat (word_of_nat n) \<le> 1023 \<longrightarrow> option_to_ptr (x (word_of_nat n)) = xa.[unat (word_of_nat n)]; x (word_of_nat n) \<noteq> Some 0; (\<exists>a. x a = Some (word_of_nat n)) \<longrightarrow> is_aligned (word_of_nat n) pdBits\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[unat (word_of_nat n)] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa. \<lbrakk>cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; n < 1024; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); dom x \<subseteq> {0..0x3FF}; option_to_ptr (x (word_of_nat n)) = xa.[n]; x (word_of_nat n) \<noteq> Some 0; (\<exists>a. x a = Some (word_of_nat n)) \<longrightarrow> is_aligned (word_of_nat n) pdBits\<rbrakk> \<Longrightarrow> (\<exists>y. x (word_of_nat n) = Some y) = (xa.[n] \<noteq> NULL)
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n s s' x xa x2. \<lbrakk>x2 \<noteq> 0; (\<exists>a. x a = Some (word_of_nat n)) \<longrightarrow> is_aligned (word_of_nat n) pdBits; cslift s' (ap_Ptr pool) = Some (asid_pool_C.asid_pool_C xa); base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; n < 1024; valid_objs' s; map_to_asidpools (ksPSpace s) pool = Some (asidpool.ASIDPool x); dom x \<subseteq> {0..0x3FF}; x (word_of_nat n) = Some x2; pde_Ptr x2 = xa.[n]\<rbrakk> \<Longrightarrow> xa.[n] \<noteq> NULL
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1127 rv poolKO n) (?Rt1125 rv poolKO n rv') [] (do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od) (CALL flushSpace_'proc(base + rv');;
CALL invalidateASIDEntry_'proc(base + rv'))
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 3. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pt1127 rv poolKO n s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rt1125 rv poolKO n (offset_' s)) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 8. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv poolKO n rv' rva xfdca. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1199 rv poolKO n rv' rva) (?Q'1199 rv poolKO n rv' rva xfdca) [] (invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)) (CALL invalidateASIDEntry_'proc(base + rv'))
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> \<lbrace>?R1201 rv poolKO n\<rbrace> flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n) \<lbrace>?Q1199 rv poolKO n rv'\<rbrace>
 3. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 4. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits) and ?R1201 rv poolKO n) s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1199 rv poolKO n (offset_' s) rva (xfdc t)}) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> \<lbrace>?R1201 rv poolKO n\<rbrace> flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n) \<lbrace>\<lambda>rva s. valid_pde_mappings' s \<and> base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits\<rbrace>
 2. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 3. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits) and ?R1201 rv poolKO n) s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>}}) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 8. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv poolKO n rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1129 rv poolKO n) (?Rf1125 rv poolKO n rv') [] (return ()) SKIP
 2. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits) and (\<lambda>s. valid_pde_mappings' s \<and> base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits)) s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ?Pf1129 rv poolKO n s) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>}}) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> ?Rf1125 rv poolKO n (offset_' s))} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (s, s') \<in> rf_sr; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s; s' \<in> \<lbrace>\<acute>offset = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (ko_at' poolKO pool and valid_objs' and (\<lambda>s. (\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits) and (\<lambda>s. valid_pde_mappings' s \<and> base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits)) s) and (\<lambda>s. (\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> True) and asid_pool_at' (ptr_val (ap_Ptr pool))) s \<and> s' \<in> {s. s \<in> {sa. (sa \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. asid_'_update (\<lambda>_. base + offset_' s) sa \<in> UNIV \<inter> \<lbrace>\<acute>asid = base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n\<rbrace>}}) \<and> (sa \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<^bsup>s\<^esup>offset] \<noteq> NULL\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset < 0x400\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>offset = word_of_nat n\<rbrace>}
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> ((\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n \<le> mask local.asid_bits) \<and> asid_pool_at' pool s \<and> (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat (word_of_nat n)] \<noteq> NULL \<longrightarrow> word_of_nat n = [0 .e. 2 ^ local.asid_low_bits - 1] ! n) \<and> word_of_nat n < 0x400
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> ((\<exists>y. inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y) \<longrightarrow> base + word_of_nat n \<le> mask local.asid_bits) \<and> word_of_nat n < 0x400
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>is_aligned base local.asid_low_bits; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> ((\<exists>y. inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y) \<longrightarrow> base + word_of_nat n \<le> mask local.asid_bits) \<and> word_of_nat n < 0x400
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>is_aligned base local.asid_low_bits; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> word_of_nat n < 0x400
 2. \<And>poolKO n s s'. \<lbrakk>is_aligned base local.asid_low_bits; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> (\<exists>y. inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y) \<longrightarrow> base + word_of_nat n \<le> mask local.asid_bits
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s'. \<lbrakk>is_aligned base local.asid_low_bits; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s\<rbrakk> \<Longrightarrow> (\<exists>y. inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y) \<longrightarrow> base + word_of_nat n \<le> mask local.asid_bits
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>is_aligned base local.asid_low_bits; base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base + word_of_nat n < 2 ^ local.asid_bits
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ local.asid_low_bits
 2. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 8. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>(s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> 2 ^ local.asid_low_bits
 2. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < unat (2 ^ local.asid_low_bits); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ local.asid_low_bits
 3. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 4. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 7. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 9. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < unat (2 ^ local.asid_low_bits); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ local.asid_low_bits
 2. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 8. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < 2 ^ local.asid_low_bits; (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ local.asid_low_bits
 2. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 6. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 8. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 2. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 5. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 7. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 10. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>poolKO n s s' y. \<lbrakk>base < 0x20000; pool \<noteq> 0; n < Suc (unat (2 ^ local.asid_low_bits - 1)); (s, s') \<in> rf_sr; offset_' s' = word_of_nat n; ko_at' poolKO pool s; valid_objs' s; valid_pde_mappings' s; inv asidpool.ASIDPool poolKO (word_of_nat n) = Some y\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 4. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 6. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 2 ^ local.asid_low_bits) = (n < word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]))
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 3. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 5. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 9. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 10. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>offset < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ap_Ptr pool} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat \<acute>offset] \<noteq> NULL THEN
  CALL flushSpace_'proc(base + \<acute>offset);;
CALL invalidateASIDEntry_'proc(base + \<acute>offset)
FI)) \<lbrace>\<acute>offset = \<^bsup>s\<^esup>offset\<rbrace>
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 4. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 8. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 9. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>t_hrs offset. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> offset < 0x400 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t ap_Ptr pool \<longrightarrow> (h_val (hrs_mem t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat offset] \<noteq> NULL \<longrightarrow> offset = offset) \<and> (h_val (hrs_mem t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr pool\<rightarrow>[''array_C''])).[unat offset] = NULL \<longrightarrow> offset = offset)
 2. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 4. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 8. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 9. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO n. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y then do y <- flushSpace (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n);
invalidateASIDEntry (base + [0 .e. 2 ^ local.asid_low_bits - 1] ! n)
od else return () \<lbrace>\<lambda>_. ko_at' poolKO pool and valid_objs' and valid_pde_mappings'\<rbrace>
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO n s. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; Suc n < length [0 .e. 2 ^ local.asid_low_bits - 1]; (ko_at' poolKO pool and valid_objs' and valid_pde_mappings') s\<rbrakk> \<Longrightarrow> ((\<exists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ko_at' poolKO pool s \<and> valid_objs' s \<and> valid_pde_mappings' s) \<and> ((\<nexists>y. inv asidpool.ASIDPool poolKO ([0 .e. 2 ^ local.asid_low_bits - 1] ! n) = Some y) \<longrightarrow> ko_at' poolKO pool s \<and> valid_objs' s \<and> valid_pde_mappings' s)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 3. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] < 4294967296
 2. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv poolKO rv' t t'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> offset_' rv' t t' (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread)) (?d'933 rv poolKO rv')
 2. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (?d'933 rv poolKO rv')
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 5. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 6. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q933 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (Guard ArrayBounds \<lbrace>base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)));;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?Q933 rv poolKO\<rbrace>
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1430 rv poolKO rva) (?Q'933 rv poolKO rva rv') [SKIP] (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL;;
CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. ?P1430 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1434 rv poolKO rva) (?Q'933 rv poolKO rva rv') [] (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL)
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. ?P1434 rv poolKO rva and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (?Q'933 rv poolKO)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. rv = armKSASIDTable (ksArchState \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) NULL {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv poolKO rva rv' \<sigma>. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> {s. rv = armKSASIDTable (ksArchState \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<sigma>). (\<sigma>', globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals s)) (unat (base >> local.asid_low_bits)) NULL)) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals s)) (unat (base >> local.asid_low_bits)) NULL)) s))}
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState \<sigma>)\<rparr>, globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) NULL)) x) \<in> rf_sr
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (\<lambda>a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) then None else armKSASIDTable (ksArchState \<sigma>) a) (Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) NULL)
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (base >> local.asid_low_bits) = unat (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base))
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 9. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 10. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (base >> 10) = unat (base >> 10) mod 128
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 9. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 10. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (base >> 10) < 128
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 9. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 10. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> base >> 10 < ?b1514 \<sigma> x v va
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (?b1514 \<sigma> x v va) \<le> 128
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 4. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 5. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> base < 2 ^ (10 + 7)
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ 7) \<le> 128
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 4. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 5. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 7. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 9. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 10. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; cslift x_ intStateIRQNode_array_Ptr = Some v_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x_ armKSGlobalPD_Ptr = Some va_; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> base < 2 ^ (10 + 7) proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ 7) \<le> 128
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 3. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 6. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 8. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 9. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 10. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>base && mask 10 = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; cslift x_ intStateIRQNode_array_Ptr = Some v_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x_ armKSGlobalPD_Ptr = Some va_; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> unat (2 ^ 7) \<le> 128 proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL
 2. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 3. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 5. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 7. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 8. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 9. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; cslift x_ intStateIRQNode_array_Ptr = Some v_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x_ armKSGlobalPD_Ptr = Some va_; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) None NULL proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x v va. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some va; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 2. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 4. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 6. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 7. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 8. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; cslift x_ intStateIRQNode_array_Ptr = Some v_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x_ armKSGlobalPD_Ptr = Some va_; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128) proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO rva rv' rvb rv'a. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1433 rv poolKO rva rv' rvb) (?Q'1433 rv poolKO rva rv' rvb rv'a) [SKIP] (getCurThread >>= setVMRoot) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?Q1433 rv poolKO rva rv'\<rbrace>
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1433 rv poolKO rva rv')
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv poolKO rva rv' rvb rv'a rvc. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1; dc rvb rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1519 rv poolKO rva rv' rvb rvc) (?P'1518 rv poolKO rva rv' rvb rv'a rvc) [SKIP] (setVMRoot rvc) (CALL setVMRoot_'proc(\<acute>ksCurThread))
 2. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ?P1519 rv poolKO rva rv' rvb rvc s\<rbrace>
 3. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'a. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> ?P'1518 rv poolKO rva rv' rvb rv'a rvc})
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 5. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 6. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 7. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> \<lbrace>?R1435 rv poolKO rva\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rvb s. \<forall>rv. ksCurThread s = rv \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' rv) s\<rbrace>
 2. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'a. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and ?R1435 rv poolKO rva and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 4. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 5. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 6. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv poolKO rva rv'. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'a. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr rv\<rbrace>}})
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>a. \<forall>rva. ksCurThread (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>) = rva \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' rva) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>)) and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 3. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 4. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 5. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>a. \<forall>rva. ksCurThread (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>) = rva \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' rva) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>)) and K (Kernel_C.asidLowBits <s 0x20) and K (0 \<le>s Kernel_C.asidLowBits) and K (base >> local.asid_low_bits < 0x80)\<rbrace>
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva x. rv = armKSASIDTable (ksArchState x) \<and> all_invs_but_ct_idle_or_in_cur_domain' (x\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState x)\<rparr>) \<and> cur_tcb' x \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80\<rbrace>
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R938 (ap_Ptr pool) base rv poolKO\<rbrace> mapM_x (\<lambda>offset. if \<exists>y. inv asidpool.ASIDPool poolKO offset = Some y then do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od else return ()) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = armKSASIDTable (ksArchState s) \<and> (invs' s \<and> rv = armKSASIDTable (ksArchState s)) \<and> cur_tcb' s \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80\<rbrace>
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and ?R938 poola asid_base rv asidpool) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv poolKO x. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; x \<in> set [0 .e. 2 ^ local.asid_low_bits - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80\<rbrace> if \<exists>y. inv asidpool.ASIDPool poolKO x = Some y then do y <- flushSpace (base + x);
invalidateASIDEntry (base + x)
od else return () \<lbrace>\<lambda>r a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80\<rbrace>
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and (\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid_base >> local.asid_low_bits < 0x80)) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv poolKO x s. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0; x \<in> set [0 .e. 2 ^ local.asid_low_bits - 1]; rv = armKSASIDTable (ksArchState s) \<and> (invs' s \<and> rv = armKSASIDTable (ksArchState s)) \<and> cur_tcb' s \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80\<rbrakk> \<Longrightarrow> ((\<exists>y. inv asidpool.ASIDPool poolKO x = Some y) \<longrightarrow> rv = armKSASIDTable (ksArchState s) \<and> invs' s \<and> rv = armKSASIDTable (ksArchState s) \<and> cur_tcb' s \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80) \<and> ((\<nexists>y. inv asidpool.ASIDPool poolKO x = Some y) \<longrightarrow> rv = armKSASIDTable (ksArchState s) \<and> (invs' s \<and> rv = armKSASIDTable (ksArchState s)) \<and> cur_tcb' s \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> base >> local.asid_low_bits < 0x80)
 2. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 3. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 4. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and (\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid_base >> local.asid_low_bits < 0x80)) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv poolKO. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length [0 .e. 2 ^ local.asid_low_bits - 1]) * word_of_nat 1) offset_' (\<lambda>rva rv'. UNIV)
 2. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 3. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and (\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid_base >> local.asid_low_bits < 0x80)) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv. \<lbrakk>base && mask local.asid_low_bits = 0; base < 0x20000; pool \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf897 (ap_Ptr pool) base rv) (?Rf895 (ap_Ptr pool) base rv) [SKIP] (return ()) SKIP
 2. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and (\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid_base >> local.asid_low_bits < 0x80)) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> ?Pf897 poola asid_base rv s)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> ?Rf895 poola asid_base rv)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSASIDTable (ksArchState s) = rv \<longrightarrow> ((\<lambda>s. rv = armKSASIDTable (ksArchState s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) = Some pool \<longrightarrow> (\<forall>asidpool. ko_at' asidpool pool s \<longrightarrow> (ko_at' asidpool pool and valid_objs' and valid_pde_mappings' and (\<lambda>a. rv = armKSASIDTable (ksArchState a) \<and> (invs' a \<and> rv = armKSASIDTable (ksArchState a)) \<and> cur_tcb' a \<and> Kernel_C.asidLowBits <s 0x20 \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid_base >> local.asid_low_bits < 0x80)) s)) and (\<lambda>s. rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid_base)) \<noteq> Some pool \<longrightarrow> True)) s) \<and> s' \<in> {s. \<forall>rv. s \<in> {s. (s \<in> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> {s. \<forall>asidpool asidpool'. cslift s poola = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> s \<in> UNIV}) \<and> (s \<notin> \<lbrace>\<acute>armKSASIDTable.[unat (asid_base >> local.asid_low_bits)] = poola\<rbrace> \<longrightarrow> s \<in> UNIV)}} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>poola asid_base s s'. \<lbrakk>base < 0x20000 \<and> pool \<noteq> 0; poola = ap_Ptr pool; asid_base = base; (s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some pool \<longrightarrow> (\<exists>asidpool. ko_at' asidpool pool s) \<longrightarrow> valid_objs' s \<and> valid_pde_mappings' s \<and> cur_tcb' s \<and> base >> local.asid_low_bits < 0x80) \<and> s' \<in> (if base >> local.asid_low_bits < 0x80 then UNIV else {}) proof (prove)
goal:
No subgoals!