theory ArchCNodeInv_AI

lemma rec_del_invs'':
  notes Inr_in_liftE_simp[simp del]
  assumes set_cap_Q[wp]: "\<And>cap p. \<lbrace>Q and invs\<rbrace> set_cap cap p \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes empty_slot_Q[wp]: "\<And>slot free_irq. \<lbrace>Q and invs\<rbrace> empty_slot slot free_irq\<lbrace>\<lambda>_.Q\<rbrace>"
  assumes finalise_cap_Q[wp]: "\<And>cap final. \<lbrace>Q and invs\<rbrace> finalise_cap cap final \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes cap_swap_for_delete_Q[wp]: "\<And>a b. \<lbrace>Q and invs and cte_at a and cte_at b and K (a \<noteq> b)\<rbrace>
                                              cap_swap_for_delete a b
                                             \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes preemption_point_Q: "\<And>cap final. \<lbrace>Q and invs\<rbrace> preemption_point \<lbrace>\<lambda>_.Q\<rbrace>"
  shows
  "s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call call
           and (\<lambda>s. \<not> exposed_rdcall call
                       \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {})
                                (slot_rdcall call) s)
           and emptyable (slot_rdcall call)
           and (\<lambda>s. case call of ReduceZombieCall cap sl ex \<Rightarrow>
                               \<not> cap_removeable cap sl
                               \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s)
                        | _ \<Rightarrow> True)\<rbrace>
         rec_del call
       \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and>
               (case call of FinaliseSlotCall sl x \<Rightarrow>
                             ((fst rv \<or> x) \<longrightarrow> cte_wp_at (replaceable s sl cap.NullCap) sl s)
                             \<and> (snd rv \<noteq> NullCap \<longrightarrow>
                                   post_cap_delete_pre (snd rv) ((caps_of_state s) (sl \<mapsto> cap.NullCap)))
                          | ReduceZombieCall cap sl x \<Rightarrow>
                             (\<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s)
                          | _ \<Rightarrow> True) \<and>
               emptyable (slot_rdcall call) s\<rbrace>,
       \<lbrace>\<lambda>rv. Q and invs\<rbrace>" proof (induct rule: rec_del.induct,
       simp_all only: rec_del_fails) case (1 slot exposed s) show ?case apply (subst rec_del.simps) apply (simp only: split_def) apply wp apply (simp(no_asm)) apply (wp empty_slot_invs empty_slot_emptyable)[1] apply (rule hoare_pre_spec_validE) apply (rule spec_strengthen_postE, unfold slot_rdcall.simps) apply (rule "1.hyps"[simplified rec_del_call.simps slot_rdcall.simps]) apply clarsimp apply (auto simp: cte_wp_at_caps_of_state) done next case (2 slot exposed s) show ?case apply (subst rec_del.simps) apply (simp only: split_def) apply (rule split_spec_bindE[rotated]) apply (rule drop_spec_validE, simp) apply (rule get_cap_sp) apply (rule hoare_pre_spec_validE) apply (wp replace_cap_invs | simp)+ apply (erule finalise_cap_not_reply_master) apply (wp "2.hyps") apply (wp preemption_point_Q | simp)+ apply (wp preemption_point_inv, simp+) apply (wp preemption_point_Q) apply ((wp preemption_point_inv irq_state_independent_A_conjI irq_state_independent_AI
                    emptyable_irq_state_independent invs_irq_state_independent
               | simp add: valid_rec_del_call_def irq_state_independent_A_def)+)[1] apply (simp(no_asm)) apply (rule spec_strengthen_postE) apply (rule "2.hyps"[simplified rec_del_call.simps slot_rdcall.simps conj_assoc], assumption+) apply (simp add: cte_wp_at_eq_simp
                | wp replace_cap_invs set_cap_sets final_cap_same_objrefs
                     set_cap_cte_cap_wp_to hoare_weak_lift_imp
                | erule finalise_cap_not_reply_master)+ apply (wp hoare_vcg_const_Ball_lift)+ apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fin s. Q s \<and> invs s \<and> replaceable s slot (fst fin) rv
                                 \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> (fst fin)
                                 \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s
                                 \<and> emptyable slot s
                                 \<and> (\<forall>t\<in>obj_refs (fst fin). halted_if_tcb t s)"
                  in hoare_vcg_conj_lift) apply (wp finalise_cap_invs[where slot=slot]
                  finalise_cap_replaceable[where sl=slot]
                  finalise_cap_makes_halted[where slot=slot])[1] apply (rule finalise_cap_cases[where slot=slot]) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule disjE) apply clarsimp apply (rule post_cap_delete_pre_is_final_cap', clarsimp+) apply (rule conjI, clarsimp) apply (subst replaceable_def) apply (clarsimp simp: is_cap_simps tcb_cap_valid_NullCapD
                             no_cap_to_obj_with_diff_ref_Null gen_obj_refs_eq
                        del: disjCI) apply (thin_tac "appropriate_cte_cap a = appropriate_cte_cap b" for a b) apply (rule conjI) apply (clarsimp simp: replaceable_def) apply (erule disjE) apply (simp only: zobj_refs.simps mem_simps) apply clarsimp+ subgoal apply (drule sym, simp) apply (drule sym, simp) apply clarsimp apply (simp add: unat_eq_0) apply (drule of_bl_eq_0) apply (drule zombie_cte_bits_less, simp add: word_bits_def) by (clarsimp simp: cte_wp_at_caps_of_state) apply (drule_tac s="appropriate_cte_cap c" for c in sym) apply (clarsimp simp: is_cap_simps appropriate_Zombie gen_obj_refs_eq) apply (simp add: is_final_cap_def) apply wp apply (clarsimp simp: cte_wp_at_eq_simp) apply (rule conjI) apply (clarsimp simp: cte_wp_at_caps_of_state replaceable_def) apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp+) apply (frule invs_valid_asid_table) apply (frule invs_sym_refs) apply (clarsimp simp add: invs_def valid_state_def invs_valid_objs invs_psp_aligned) apply (drule(1) if_unsafe_then_capD, clarsimp+) done next have replicate_helper:
    "\<And>x n. True \<in> set x \<Longrightarrow> replicate n False \<noteq> x" by (clarsimp simp: replicate_not_True) case (3 ptr bits n slot s) show ?case apply simp apply wp+ apply clarsimp apply (rule context_conjI') apply (rule context_conjI') apply (rule conjI) apply (erule zombie_is_cap_toE2) apply simp+ apply (clarsimp simp: halted_emptyable) apply (rule conjI, clarsimp simp: cte_wp_at_caps_of_state) apply (erule tcb_valid_nonspecial_cap) apply fastforce apply (clarsimp simp: ran_tcb_cap_cases is_cap_simps is_nondevice_page_cap_simps
                       split: Structures_A.thread_state.splits) apply (clarsimp simp: is_cap_simps is_nondevice_page_cap_simps) apply (rule conjI) apply (drule cte_wp_valid_cap, clarsimp) apply (frule cte_at_nat_to_cref_zbits [where m=0], simp) apply (rule cte_wp_at_not_reply_master) apply (simp add: replicate_helper tcb_cnode_index_def) apply (subst(asm) nat_to_cref_0_replicate) apply (simp add: zombie_cte_bits_less) apply assumption apply clarsimp apply (simp add: invs_def valid_state_def) apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps) apply (erule cte_wp_at_weakenE | clarsimp)+ done next have nat_helper:
    "\<And>x n. \<lbrakk> x < Suc n; x \<noteq> n \<rbrakk> \<Longrightarrow> x < n" by (simp add: le_simps) case (4 ptr bits n slot s) show ?case apply simp apply (rule hoare_pre_spec_validE) apply (wp replace_cap_invs | simp add: is_cap_simps)+ apply (rule_tac Q="\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s
                             \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap
                                        \<or> \<not> False \<and> is_zombie cap
                                            \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n)
                                                 \<in> fst_cte_ptrs cap)
                                    (ptr, nat_to_cref (zombie_cte_bits bits) n) s
                             \<and> \<not> cap_removeable (cap.Zombie ptr bits (Suc n)) slot"
                  in hoare_post_imp) apply (thin_tac "(a, b) \<in> fst c" for a b c) apply clarsimp apply (frule cte_wp_at_emptyableD, clarsimp, assumption) apply (rule conjI[rotated], (clarsimp simp: is_cap_simps)+) apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp+) apply (frule if_unsafe_then_capD, clarsimp+) apply (rule conjI) apply (frule zombies_finalD, (clarsimp simp: is_cap_simps)+) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule disjE[where P="val = cap.NullCap" for val]) apply (clarsimp simp: replaceable_def cap_range_def is_cap_simps
                               gen_obj_refs_subset vs_cap_ref_def) apply (rule conjI[rotated]) apply (rule conjI) apply (rule mp [OF tcb_cap_valid_imp']) apply (fastforce simp: ran_tcb_cap_cases is_cap_simps
                                 is_pt_cap_def vs_cap_ref_def
                                 is_nondevice_page_cap_simps
                                 valid_ipc_buffer_cap_def
                          split: thread_state.splits) apply (drule unique_table_refs_no_cap_asidD) apply (simp add: invs_def valid_state_def valid_arch_caps_def) apply (simp add: no_cap_to_obj_with_diff_ref_def Ball_def
                           table_cap_ref_def) apply clarsimp apply (rule ccontr, erule notE, erule nat_helper) apply clarsimp apply (erule disjE[where Q="val = slot" for val]) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule notE[rotated, where P="val = Some cap.NullCap" for val]) apply (drule sym, simp, subst nat_to_cref_unat_of_bl) apply (drule zombie_cte_bits_less, simp add: word_bits_def) apply assumption apply clarsimp apply (drule sym, simp) apply (subst(asm) nat_to_cref_unat_of_bl) apply (drule zombie_cte_bits_less, simp add: word_bits_conv) apply simp apply (clarsimp simp: is_final_cap'_def3 simp del: split_paired_All) apply (frule_tac x=slot in spec) apply (drule_tac x="(ptr, nat_to_cref (zombie_cte_bits bits) n)" in spec) apply (clarsimp simp: cte_wp_at_caps_of_state fst_cte_ptrs_def
                              gen_obj_refs_Int) apply (drule(1) nat_to_cref_replicate_Zombie[OF sym]) apply simp apply simp apply (clarsimp simp: valid_cap_def cap_aligned_def is_cap_simps
                             cte_wp_at_cte_at appropriate_Zombie
                      split: option.split_asm) apply (wp get_cap_cte_wp_at)[1] apply simp apply (subst conj_assoc[symmetric]) apply (rule spec_valid_conj_liftE2) apply (wp rec_del_delete_cases[where ex=False, simplified])[1] apply (rule spec_strengthen_postE) apply (rule "4.hyps"[simplified rec_del_call.simps slot_rdcall.simps simp_thms pred_conj_def]) apply (simp add: in_monad) apply simp apply (clarsimp simp: halted_emptyable) apply (erule(1) zombie_is_cap_toE) apply simp apply simp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call call and (\<lambda>s. \<not> exposed_rdcall call \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall call) s) and emptyable (slot_rdcall call) and (\<lambda>s. case call of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del call \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case call of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall call) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
goal (4 subgoals):
 1. \<And>slot exposed s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
this:
s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (4 subgoals):
 1. \<And>slot exposed s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> doE (success, cleanup_info) <- rec_del (FinaliseSlotCall slot exposed);
without_preemption $ when (exposed \<or> success) $ empty_slot slot cleanup_info;
returnOk undefined
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> doE p <- rec_del (FinaliseSlotCall slot exposed);
without_preemption $ when (exposed \<or> fst p) $ empty_slot slot (snd p);
returnOk undefined
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s); exposed \<or> fst rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'15 rv\<rbrace> empty_slot slot (snd rv) \<lbrace>\<lambda>rv s. invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>
 2. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>a. if exposed \<or> fst a then \<lambda>aa. (Q and invs) aa \<and> ?P'15 a aa else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) a)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s); exposed \<or> fst rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'15 rv\<rbrace> empty_slot slot (snd rv) \<lbrace>\<lambda>rv s. invs s \<and> emptyable slot s\<rbrace>
 2. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>a. if exposed \<or> fst a then \<lambda>aa. (Q and invs) aa \<and> ?P'15 a aa else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) a)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>a. if exposed \<or> fst a then \<lambda>aa. (Q and invs) aa \<and> (invs aa \<and> cte_wp_at (replaceable aa slot NullCap) slot aa \<and> emptyable slot aa \<and> (snd a \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd a) ((caps_of_state aa)(slot \<mapsto> NullCap)))) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) aa else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) a)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'32\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>a. if exposed \<or> fst a then \<lambda>aa. (Q and invs) aa \<and> (invs aa \<and> cte_wp_at (replaceable aa slot NullCap) slot aa \<and> emptyable slot aa \<and> (snd a \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd a) ((caps_of_state aa)(slot \<mapsto> NullCap)))) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) aa else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) a)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. (Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<Longrightarrow> ?P'32 s proof (prove)
goal (3 subgoals):
 1. s \<turnstile> \<lbrace>?P'32\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>?Q'35\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>s r. ?Q'35 s r \<Longrightarrow> (if exposed \<or> fst s then \<lambda>a. (Q and invs) a \<and> (invs a \<and> cte_wp_at (replaceable a slot NullCap) slot a \<and> emptyable slot a \<and> (snd s \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd s) ((caps_of_state a)(slot \<mapsto> NullCap)))) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) a else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable slot a)) r
 3. (Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<Longrightarrow> ?P'32 s proof (prove)
goal (2 subgoals):
 1. \<And>s r. Q r \<and> invs r \<and> ((fst s \<or> exposed \<longrightarrow> cte_wp_at (replaceable r slot NullCap) slot r) \<and> (snd s \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd s) ((caps_of_state r)(slot \<mapsto> NullCap)))) \<and> emptyable slot r \<Longrightarrow> (if exposed \<or> fst s then \<lambda>a. (Q and invs) a \<and> (invs a \<and> cte_wp_at (replaceable a slot NullCap) slot a \<and> emptyable slot a \<and> (snd s \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd s) ((caps_of_state a)(slot \<mapsto> NullCap)))) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) a else (\<lambda>a. Q a \<and> invs a \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst undefined \<or> x \<longrightarrow> cte_wp_at (replaceable a sl NullCap) sl a) \<and> (snd undefined \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd undefined) ((caps_of_state a)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl a) \<and> emptyable slot a)) r
 2. (Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<Longrightarrow> (Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. True)) s proof (prove)
goal (2 subgoals):
 1. \<And>a b r. \<lbrakk>Q r; invs r; a \<longrightarrow> cte_wp_at (replaceable r slot NullCap) slot r; exposed \<longrightarrow> cte_wp_at (replaceable r slot NullCap) slot r; b \<noteq> NullCap \<longrightarrow> post_cap_delete_pre b ((caps_of_state r)(slot \<mapsto> NullCap)); emptyable slot r\<rbrakk> \<Longrightarrow> (exposed \<longrightarrow> cte_wp_at (\<lambda>_. True) slot r) \<and> (a \<longrightarrow> cte_wp_at (\<lambda>_. True) slot r)
 2. (Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<Longrightarrow> (Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. True)) s proof (prove)
goal:
No subgoals! proof (state)
this:
s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s); ?rv \<noteq> NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb)\<rbrakk> \<Longrightarrow> ?stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst ?rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst ?rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst ?rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst ?rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst ?rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s); ?rv \<noteq> NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb); (Inr ?rvd, ?std) \<in> fst (rec_del (ReduceZombieCall (fst ?rvb) slot exposed) ?stc); (Inr ?rve, ?ste) \<in> fst (preemption_point ?std)\<rbrakk> \<Longrightarrow> ?ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> stc \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> doE cap <- without_preemption $ get_cap slot;
if cap = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> doE cap <- without_preemption $ get_cap slot;
if cap = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
p <- without_preemption $ finalise_cap cap is_final;
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE without_preemption $ set_cap (fst p) slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap (fst p) slot;
rec_del (ReduceZombieCall (fst p) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> without_preemption $ get_cap slot \<lbrace>?B\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s) \<Longrightarrow> s'' \<turnstile> \<lbrace>?B rv\<rbrace> if rv = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap rv;
p <- without_preemption $ finalise_cap rv is_final;
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE without_preemption $ set_cap (fst p) slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap (fst p) slot;
rec_del (ReduceZombieCall (fst p) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot\<rbrace> get_cap slot \<lbrace>?B\<rbrace>
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s) \<Longrightarrow> s'' \<turnstile> \<lbrace>?B rv\<rbrace> if rv = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap rv;
p <- without_preemption $ finalise_cap rv is_final;
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE without_preemption $ set_cap (fst p) slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap (fst p) slot;
rec_del (ReduceZombieCall (fst p) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. (Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s) \<Longrightarrow> s'' \<turnstile> \<lbrace>Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot\<rbrace> if rv = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap rv;
p <- without_preemption $ finalise_cap rv is_final;
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE without_preemption $ set_cap (fst p) slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap (fst p) slot;
rec_del (ReduceZombieCall (fst p) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. (Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s) \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'6 rv s''\<rbrace> if rv = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap rv;
p <- without_preemption $ finalise_cap rv is_final;
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE without_preemption $ set_cap (fst p) slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap (fst p) slot;
rec_del (ReduceZombieCall (fst p) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> ?P'6 rv s'' s'' proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst (liftE (finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> \<not> is_master_reply_cap (fst rvb)
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> doE without_preemption $ set_cap (fst rvb) slot;
rec_del (ReduceZombieCall (fst rvb) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> doE without_preemption $ set_cap (fst rvb) slot;
rec_del (ReduceZombieCall (fst rvb) slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b); (Inr rvd, s''d) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B59 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> preemption_point \<lbrace>\<lambda>rve. Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?B59 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst (liftE (finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; (Inr (), s''c) \<in> fst (liftE (set_cap (fst rvb) slot) s''b); (Inr rvd, s''d) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s''c)\<rbrakk> \<Longrightarrow> \<lbrace>?P'70 rv s'' rva s''a rvb s''b () s''c rvd\<rbrace> preemption_point \<lbrace>\<lambda>rve s. Q s \<and> invs s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv. invs\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd s. (Q and invs) s \<and> ?P'70 rv s'' rva s''a rvb s''b rvc s''c rvd s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst (liftE (finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; (Inr (), s''c) \<in> fst (liftE (set_cap (fst rvb) slot) s''b); (Inr rvd, s''d) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s''c)\<rbrakk> \<Longrightarrow> \<lbrace>?P'80 rv s'' rva s''a rvb s''b () s''c rvd\<rbrace> preemption_point \<lbrace>\<lambda>rve s. Q s \<and> invs s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd s. (Q and invs) s \<and> invs s \<and> ?P'80 rv s'' rva s''a rvb s''b rvc s''c rvd s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst (liftE (finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; (Inr (), s''c) \<in> fst (liftE (set_cap (fst rvb) slot) s''b); (Inr rvd, s''d) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s''c)\<rbrakk> \<Longrightarrow> \<lbrace>?P'88 rv s'' rva s''a rvb s''b () s''c rvd\<rbrace> preemption_point \<lbrace>\<lambda>rv s. invs s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd s. (Q and invs) s \<and> invs s \<and> (Q and invs) s \<and> ?P'88 rv s'' rva s''a rvb s''b rvc s''c rvd s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd s. (Q and invs) s \<and> invs s \<and> (Q and invs) s \<and> invs s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b ()\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd s. Q s \<and> invs s \<and> Q s \<and> invs s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B57 rv s'' rva s''a rvb s''b ()\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?Q'118 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c s r. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b); ?Q'118 rv s'' rva s''a rvb s''b rvc s''c s r\<rbrakk> \<Longrightarrow> Q r \<and> invs r \<and> Q r \<and> invs r \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot r) \<and> emptyable slot r
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>?B57 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s r. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s''c) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) s''b); Q r \<and> invs r \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot r) \<and> emptyable slot r\<rbrakk> \<Longrightarrow> Q r \<and> invs r \<and> Q r \<and> invs r \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot r) \<and> emptyable slot r
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst ((without_preemption $ finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'26 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>\<lambda>a. Q and invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. \<not> cap_removeable (fst rvb) slot \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'26 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); (Inr rvb, s''b) \<in> fst (liftE (finalise_cap rv rva) s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<lbrace>?P'174 rv s'' rva s''a rvb\<rbrace> set_cap (fst rvb) slot \<lbrace>\<lambda>rv s. \<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B13 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> ?P'174 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?B13 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s)))\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?B13 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q192 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); ?Q192 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>?B13 rv s''\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P197 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>fin s. Q s \<and> invs s \<and> replaceable s slot (fst fin) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst fin \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst fin). halted_if_tcb t s)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'198 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'195 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb s. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Q s \<and> invs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> ?Q'195 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P197 rv s'' rva s \<and> ?P'198 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'198 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'195 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Q s \<and> invs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> ?Q'195 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> ?P'198 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a rvb s. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s''); (Q s \<and> invs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> (fst rvb = NullCap \<and> snd rvb = (if rva then cap_cleanup_opt rv else NullCap) \<and> (snd rvb \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie (fst rvb) \<and> is_final_cap' rv s \<and> is_final_cap' (fst rvb) s \<and> snd rvb = NullCap \<and> appropriate_cte_cap (fst rvb) = appropriate_cte_cap rv \<and> cte_refs (fst rvb) = cte_refs rv \<and> gen_obj_refs (fst rvb) = gen_obj_refs rv \<and> obj_size (fst rvb) = obj_size rv \<and> fst_cte_ptrs (fst rvb) = fst_cte_ptrs rv \<and> vs_cap_ref rv = None)\<rbrakk> \<Longrightarrow> (cap_removeable (fst rvb) slot \<longrightarrow> Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, snd rvb) \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd (True, snd rvb) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, snd rvb)) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (Q and invs) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> True \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s)))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a a b s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_removeable a slot \<longrightarrow> replaceable s slot NullCap rv \<and> (b \<noteq> NullCap \<longrightarrow> post_cap_delete_pre b ((caps_of_state s)(slot \<mapsto> NullCap)))) \<and> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s)))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s)\<rbrakk> \<Longrightarrow> (cap_removeable a slot \<longrightarrow> replaceable s slot NullCap rv \<and> (b \<noteq> NullCap \<longrightarrow> post_cap_delete_pre b ((caps_of_state s)(slot \<mapsto> NullCap)))) \<and> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s)))
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_removeable a slot \<longrightarrow> replaceable s slot NullCap rv \<and> (b \<noteq> NullCap \<longrightarrow> post_cap_delete_pre b ((caps_of_state s)(slot \<mapsto> NullCap)))) \<and> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr True, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot NullCap rv; caps_of_state s slot = Some rv; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; is_final_cap' rv s; rva; cap_cleanup_opt rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> post_cap_delete_pre (cap_cleanup_opt rv) ((caps_of_state s)(slot \<mapsto> NullCap))
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_removeable a slot \<longrightarrow> replaceable s slot NullCap rv \<and> (b \<noteq> NullCap \<longrightarrow> post_cap_delete_pre b ((caps_of_state s)(slot \<mapsto> NullCap)))) \<and> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_removeable a slot \<longrightarrow> replaceable s slot NullCap rv) \<and> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s)))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None; cap_removeable a slot\<rbrakk> \<Longrightarrow> replaceable s slot NullCap rv
 2. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None; cap_removeable a slot\<rbrakk> \<Longrightarrow> rv = NullCap \<or> \<not> is_final_cap' rv s \<and> NullCap = NullCap \<and> replaceable_non_final_arch_cap s slot NullCap rv \<or> is_final_cap' rv s \<and> (\<forall>p\<in>zobj_refs rv - zobj_refs NullCap. obj_at (Not \<circ> live) p s) \<and> (\<forall>p'. p' \<in> cte_refs rv (interrupt_irq_node s) \<and> (p' \<notin> cte_refs NullCap (interrupt_irq_node s) \<or> (\<exists>cp. appropriate_cte_cap cp rv \<and> \<not> appropriate_cte_cap cp NullCap)) \<longrightarrow> (p' \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) p' s) \<and> (p' = slot \<longrightarrow> NullCap = NullCap)) \<and> gen_obj_refs NullCap \<subseteq> gen_obj_refs rv \<and> (NullCap \<noteq> NullCap \<longrightarrow> cap_range NullCap = cap_range rv) \<and> (is_master_reply_cap rv \<longrightarrow> NullCap = NullCap) \<and> (is_reply_cap rv \<longrightarrow> NullCap = NullCap) \<and> (\<not> is_master_reply_cap rv \<longrightarrow> tcb_cap_valid rv slot s \<longrightarrow> tcb_cap_valid NullCap slot s) \<and> \<not> is_untyped_cap NullCap \<and> \<not> is_master_reply_cap NullCap \<and> \<not> is_reply_cap NullCap \<and> NullCap \<noteq> IRQControlCap \<and> (NullCap \<noteq> NullCap \<longrightarrow> cap_class NullCap = cap_class rv \<and> cap_is_device NullCap = cap_is_device rv) \<and> replaceable_final_arch_cap s slot NullCap rv
 2. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; appropriate_cte_cap (Zombie r b n) = appropriate_cte_cap rv; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> (\<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s)
 2. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> (\<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s)
 2. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> \<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s
 2. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> \<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s
 3. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a s r b n p. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; rv = Zombie r b n \<or> (\<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s) \<and> gen_obj_refs (Zombie r b n) \<subseteq> gen_obj_refs rv \<and> cap_range (Zombie r b n) = cap_range rv \<and> \<not> is_master_reply_cap rv \<and> \<not> is_reply_cap rv \<and> (\<not> is_master_reply_cap rv \<longrightarrow> tcb_cap_valid rv slot s \<longrightarrow> tcb_cap_valid (Zombie r b n) slot s) \<and> \<not> is_master_reply_cap (Zombie r b n) \<and> \<not> is_reply_cap (Zombie r b n) \<and> PhysicalClass = cap_class rv \<and> \<not> cap_is_device rv \<and> no_cap_to_obj_with_diff_ref (Zombie r b n) {slot} s \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap cap' \<or> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (is_pt_cap (Zombie r b n) \<and> is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap cap' \<or> is_pt_cap (Zombie r b n) \<and> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot)); caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; p \<in> zobj_refs rv\<rbrakk> \<Longrightarrow> obj_at (Not \<circ> live) p s
 2. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> \<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s
 3. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a s r b n p. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; p \<in> zobj_refs rv; rv = Zombie r b n\<rbrakk> \<Longrightarrow> obj_at (Not \<circ> live) p s
 2. \<And>rv s'' rva s''a s r b n p. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; p \<in> zobj_refs rv; (\<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s) \<and> gen_obj_refs (Zombie r b n) \<subseteq> gen_obj_refs rv \<and> cap_range (Zombie r b n) = cap_range rv \<and> \<not> is_master_reply_cap rv \<and> \<not> is_reply_cap rv \<and> (\<not> is_master_reply_cap rv \<longrightarrow> tcb_cap_valid rv slot s \<longrightarrow> tcb_cap_valid (Zombie r b n) slot s) \<and> \<not> is_master_reply_cap (Zombie r b n) \<and> \<not> is_reply_cap (Zombie r b n) \<and> PhysicalClass = cap_class rv \<and> \<not> cap_is_device rv \<and> no_cap_to_obj_with_diff_ref (Zombie r b n) {slot} s \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap cap' \<or> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (is_pt_cap (Zombie r b n) \<and> is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap cap' \<or> is_pt_cap (Zombie r b n) \<and> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot))\<rbrakk> \<Longrightarrow> obj_at (Not \<circ> live) p s
 3. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> \<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s
 4. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a s r b n p. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; p \<in> zobj_refs rv; (\<forall>p\<in>zobj_refs rv. obj_at (Not \<circ> live) p s) \<and> gen_obj_refs (Zombie r b n) \<subseteq> gen_obj_refs rv \<and> cap_range (Zombie r b n) = cap_range rv \<and> \<not> is_master_reply_cap rv \<and> \<not> is_reply_cap rv \<and> (\<not> is_master_reply_cap rv \<longrightarrow> tcb_cap_valid rv slot s \<longrightarrow> tcb_cap_valid (Zombie r b n) slot s) \<and> \<not> is_master_reply_cap (Zombie r b n) \<and> \<not> is_reply_cap (Zombie r b n) \<and> PhysicalClass = cap_class rv \<and> \<not> cap_is_device rv \<and> no_cap_to_obj_with_diff_ref (Zombie r b n) {slot} s \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (\<forall>r\<in>obj_refs rv. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap (Zombie r b n) \<longrightarrow> (is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap (Zombie r b n) \<and> is_pd_cap cap' \<or> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot)) \<and> (is_pd_cap (Zombie r b n) \<longrightarrow> (is_pt_cap (Zombie r b n) \<and> is_pt_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<and> (is_pd_cap rv \<longrightarrow> (\<exists>y. cap_asid rv = Some y)) \<longrightarrow> (\<forall>a ba. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs rv \<and> (is_pd_cap cap' \<or> is_pt_cap (Zombie r b n) \<and> is_pt_cap cap')) (a, ba) s \<longrightarrow> (a, ba) = slot))\<rbrakk> \<Longrightarrow> obj_at (Not \<circ> live) p s
 2. \<And>rv s'' rva s''a s r b n. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv\<rbrakk> \<Longrightarrow> \<forall>a b. (a, b) \<in> cte_refs rv (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (a, b) s
 3. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a s r b n a ba. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot (Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> Zombie r b n; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; is_final_cap' rv s; is_final_cap' (Zombie r b n) s; cte_refs (Zombie r b n) = cte_refs rv; (case b of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv; fst_cte_ptrs (Zombie r b n) = fst_cte_ptrs rv; vs_cap_ref rv = None; n = 0 \<or> n = Suc 0 \<and> (r, replicate (zombie_cte_bits b) False) = slot; {r} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (a, ba) \<in> cte_refs rv (interrupt_irq_node s); (a, ba) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) (a, ba) s
 2. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap slot) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ slot (Zombie r_ b_ n_) rv_; caps_of_state s_ slot = Some rv_; s_ \<turnstile> Zombie r_ b_ n_; ex_cte_cap_wp_to (appropriate_cte_cap rv_) slot s_; emptyable slot s_; \<forall>t\<in>obj_refs rv_. halted_if_tcb t s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ n_) s_; cte_refs (Zombie r_ b_ n_) = cte_refs rv_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ n_) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; n_ = 0 \<or> n_ = Suc 0 \<and> (r_, replicate (zombie_cte_bits b_) False) = slot; {r_} = obj_refs rv_; {} = cap_irqs rv_; {} = arch_gen_refs rv_; (a_, ba_) \<in> cte_refs rv_ (interrupt_irq_node s_); (a_, ba_) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) (a_, ba_) s_ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap slot) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ slot (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ slot = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) slot s_; emptyable slot s_; \<forall>t\<in>obj_refs rv_. halted_if_tcb t s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; n_ = Suc 0 \<and> (r_, replicate (zombie_cte_bits b_) False) = slot; {r_} = obj_refs rv_; {} = cap_irqs rv_; {} = arch_gen_refs rv_; a_ \<in> obj_refs rv_ \<and> length ba_ = zombie_cte_bits b_ \<and> unat (of_bl ba_) = 0; (a_, ba_) \<noteq> slot; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0))\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) (a_, ba_) s_ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap slot) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ slot (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ slot = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) slot s_; emptyable slot s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; n_ = Suc 0 \<and> (r_, replicate (zombie_cte_bits b_) False) = slot; {} = cap_irqs rv_; {} = arch_gen_refs rv_; a_ = r_ \<and> length ba_ = zombie_cte_bits b_ \<and> unat (of_bl ba_) = 0; (r_, ba_) \<noteq> slot; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) (r_, ba_) s_ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap (r_, replicate (zombie_cte_bits b_) False)) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ (r_, replicate (zombie_cte_bits b_) False) (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ (r_, replicate (zombie_cte_bits b_) False) = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) (r_, replicate (zombie_cte_bits b_) False) s_; emptyable (r_, replicate (zombie_cte_bits b_) False) s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; {} = cap_irqs rv_; {} = arch_gen_refs rv_; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}; n_ = Suc 0; slot = (r_, replicate (zombie_cte_bits b_) False); \<not> cte_wp_at ((=) NullCap) (r_, ba_) s_; a_ = r_; length ba_ = zombie_cte_bits b_; unat (of_bl ba_) = 0\<rbrakk> \<Longrightarrow> ba_ = replicate (zombie_cte_bits b_) False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap (r_, replicate (zombie_cte_bits b_) False)) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ (r_, replicate (zombie_cte_bits b_) False) (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ (r_, replicate (zombie_cte_bits b_) False) = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) (r_, replicate (zombie_cte_bits b_) False) s_; emptyable (r_, replicate (zombie_cte_bits b_) False) s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; {} = cap_irqs rv_; {} = arch_gen_refs rv_; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}; n_ = Suc 0; slot = (r_, replicate (zombie_cte_bits b_) False); \<not> cte_wp_at ((=) NullCap) (r_, ba_) s_; a_ = r_; length ba_ = zombie_cte_bits b_; of_bl ba_ = 0\<rbrakk> \<Longrightarrow> ba_ = replicate (zombie_cte_bits b_) False proof (prove)
goal (2 subgoals):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap (r_, replicate (zombie_cte_bits b_) False)) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ (r_, replicate (zombie_cte_bits b_) False) (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ (r_, replicate (zombie_cte_bits b_) False) = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) (r_, replicate (zombie_cte_bits b_) False) s_; emptyable (r_, replicate (zombie_cte_bits b_) False) s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; {} = cap_irqs rv_; {} = arch_gen_refs rv_; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}; n_ = Suc 0; slot = (r_, replicate (zombie_cte_bits b_) False); \<not> cte_wp_at ((=) NullCap) (r_, ba_) s_; a_ = r_; length ba_ = zombie_cte_bits b_\<rbrakk> \<Longrightarrow> length ba_ \<le> LENGTH(32)
 2. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap (r_, replicate (zombie_cte_bits b_) False)) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ (r_, replicate (zombie_cte_bits b_) False) (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ (r_, replicate (zombie_cte_bits b_) False) = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) (r_, replicate (zombie_cte_bits b_) False) s_; emptyable (r_, replicate (zombie_cte_bits b_) False) s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; {} = cap_irqs rv_; {} = arch_gen_refs rv_; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}; n_ = Suc 0; slot = (r_, replicate (zombie_cte_bits b_) False); \<not> cte_wp_at ((=) NullCap) (r_, ba_) s_; a_ = r_; length ba_ = zombie_cte_bits b_; \<exists>n. ba_ = replicate n False\<rbrakk> \<Longrightarrow> ba_ = replicate (zombie_cte_bits b_) False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(Inr rv_, s''_) \<in> fst (liftE (get_cap (r_, replicate (zombie_cte_bits b_) False)) s); rv_ \<noteq> NullCap; (Inr rva_, s''a_) \<in> fst (liftE (is_final_cap rv_) s''_); Q s_; invs s_; replaceable s_ (r_, replicate (zombie_cte_bits b_) False) (Zombie r_ b_ (Suc 0)) rv_; caps_of_state s_ (r_, replicate (zombie_cte_bits b_) False) = Some rv_; s_ \<turnstile> Zombie r_ b_ (Suc 0); ex_cte_cap_wp_to (appropriate_cte_cap rv_) (r_, replicate (zombie_cte_bits b_) False) s_; emptyable (r_, replicate (zombie_cte_bits b_) False) s_; halted_if_tcb r_ s_; is_final_cap' rv_ s_; is_final_cap' (Zombie r_ b_ (Suc 0)) s_; (case b_ of None \<Rightarrow> 1 << obj_bits (TCB undefined) | Some n \<Rightarrow> 1 << cte_level_bits + n) = obj_size rv_; fst_cte_ptrs (Zombie r_ b_ (Suc 0)) = fst_cte_ptrs rv_; vs_cap_ref rv_ = None; {} = cap_irqs rv_; {} = arch_gen_refs rv_; cte_refs rv_ = cte_refs (Zombie r_ b_ (Suc 0)); obj_refs rv_ = {r_}; n_ = Suc 0; slot = (r_, replicate (zombie_cte_bits b_) False); \<not> cte_wp_at ((=) NullCap) (r_, ba_) s_; a_ = r_; length ba_ = zombie_cte_bits b_; \<exists>n. ba_ = replicate n False\<rbrakk> \<Longrightarrow> ba_ = replicate (zombie_cte_bits b_) False proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; appropriate_cte_cap a = appropriate_cte_cap rv; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (3 subgoals):
 1. \<And>rv s'' rva s''a a s. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst (liftE (is_final_cap rv) s''); Q s; invs s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; is_zombie a; is_final_cap' rv s; is_final_cap' a s; cte_refs a = cte_refs rv; gen_obj_refs a = gen_obj_refs rv; obj_size a = obj_size rv; fst_cte_ptrs a = fst_cte_ptrs rv; vs_cap_ref rv = None; appropriate_cte_cap rv = appropriate_cte_cap a\<rbrakk> \<Longrightarrow> \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> a \<noteq> NullCap) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> a \<noteq> NullCap \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ((Q and invs) s \<and> (invs and cte_wp_at ((=) rv) slot) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) slot) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'10 rv s''\<rbrace> liftE (gets (is_final_cap' rv)) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> emptyable slot s \<and> invs s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'10 rv s'' s'') proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((without_preemption $ get_cap slot) s); (Q and invs and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and cte_wp_at (\<lambda>c. c = rv) slot) s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst (True, NullCap) \<or> x \<longrightarrow> cte_wp_at (replaceable s'' sl NullCap) sl s'') \<and> (snd (True, NullCap) \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd (True, NullCap)) ((caps_of_state s'')(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s'') \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s'') \<and> (rv \<noteq> NullCap \<longrightarrow> Q s'' \<and> invs s'' \<and> cte_wp_at ((=) rv) slot s'' \<and> s'' \<turnstile> rv \<and> is_final_cap' rv s'' = is_final_cap' rv s'' \<and> valid_mdb s'' \<and> cte_wp_at ((=) rv) slot s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> cte_wp_at ((=) rv) slot s'' \<and> s'' \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' \<and> emptyable slot s'' \<and> invs s'' \<and> s'' \<turnstile> rv \<and> is_final_cap' rv s'' = is_final_cap' rv s'' \<and> cte_wp_at ((=) rv) slot s'' \<and> (is_final_cap' rv s'' \<longrightarrow> is_final_cap' rv s'' \<and> cte_wp_at ((=) rv) slot s'')) proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''\<rbrakk> \<Longrightarrow> (rv = NullCap \<longrightarrow> cte_wp_at (replaceable s'' slot NullCap) slot s'') \<and> (rv \<noteq> NullCap \<longrightarrow> s'' \<turnstile> rv \<and> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> s'' \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' \<and> s'' \<turnstile> rv) proof (prove)
goal (2 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''\<rbrakk> \<Longrightarrow> rv = NullCap \<longrightarrow> cte_wp_at (replaceable s'' slot NullCap) slot s''
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''\<rbrakk> \<Longrightarrow> rv \<noteq> NullCap \<longrightarrow> s'' \<turnstile> rv \<and> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> s'' \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' \<and> s'' \<turnstile> rv proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''\<rbrakk> \<Longrightarrow> rv \<noteq> NullCap \<longrightarrow> s'' \<turnstile> rv \<and> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> s'' \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' \<and> s'' \<turnstile> rv proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''; s'' \<turnstile> rv; rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''; s'' \<turnstile> rv; rv \<noteq> NullCap; valid_asid_table (asid_table s'') s''\<rbrakk> \<Longrightarrow> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; invs s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''; s'' \<turnstile> rv; rv \<noteq> NullCap; valid_asid_table (asid_table s'') s''; sym_refs (state_refs_of s'')\<rbrakk> \<Longrightarrow> valid_mdb s'' \<and> valid_objs s'' \<and> sym_refs (state_refs_of s'') \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s'' \<and> valid_global_refs s'') \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s'' \<and> valid_vspace_objs s'' \<and> valid_arch_state s'' \<and> valid_arch_caps s'') \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' proof (prove)
goal (1 subgoal):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); Q s''; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s''; emptyable slot s''; cte_wp_at (\<lambda>c. c = rv) slot s''; s'' \<turnstile> rv; rv \<noteq> NullCap; valid_asid_table (asid_table s'') s''; sym_refs (state_refs_of s''); valid_pspace s''; valid_mdb s''; valid_ioc s''; valid_idle s''; only_idle s''; if_unsafe_then_cap s''; valid_reply_caps s''; valid_reply_masters s''; valid_global_refs s''; valid_arch_state s''; valid_irq_node s''; valid_irq_handlers s''; valid_irq_states s''; valid_machine_state s''; valid_vspace_objs s''; valid_arch_caps s''; valid_global_objs s''; valid_kernel_mappings s''; equal_kernel_mappings s''; valid_asid_map s''; valid_global_vspace_mappings s''; pspace_in_kernel_window s''; cap_refs_in_kernel_window s''; pspace_respects_device_region s''; cap_refs_respects_device_region s''; cur_tcb s''\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s'' proof (prove)
goal:
No subgoals! proof (state)
this:
s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (FinaliseSlotCall slot exposed) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case FinaliseSlotCall slot exposed of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (2 subgoals):
 1. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
goal (2 subgoals):
 1. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x n. True \<in> set x \<Longrightarrow> replicate n False \<noteq> x proof (state)
this:
True \<in> set ?x \<Longrightarrow> replicate ?n False \<noteq> ?x

goal (2 subgoals):
 1. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
this:


goal (2 subgoals):
 1. \<And>ptr bits n slot s. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>a. Q a \<and> invs a \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (Zombie ptr bits (Suc n)) a \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a \<and> emptyable slot a \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr a\<rbrace> doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> Q s \<and> invs s \<and> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> K ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) s \<and> (invs and ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) and ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot and (\<lambda>s. \<forall>c. tcb_cap_valid c (ptr, replicate (zombie_cte_bits bits) False) s) and (\<lambda>s. \<forall>c. tcb_cap_valid c slot s) and cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) and cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot) s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> (emptyable slot and emptyable (ptr, replicate (zombie_cte_bits bits) False)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> 0 < Suc n
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cap_irqs (Zombie ptr bits (Suc n)) = {}
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s c. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> tcb_cap_valid c slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (6 subgoals):
 1. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>ptra st. \<forall>(getF, setF, restr)\<in>ran tcb_cap_cases. \<not> restr ptra st (Zombie ptr bits (Suc n)) \<or> (\<forall>cap. restr ptra st cap)
 3. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>ptra. (is_nondevice_page_cap (Zombie ptr bits (Suc n)) \<or> Zombie ptr bits (Suc n) = NullCap) \<and> valid_ipc_buffer_cap (Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap c ptra
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (5 subgoals):
 1. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>ptra st. \<forall>(getF, setF, restr)\<in>ran tcb_cap_cases. \<not> restr ptra st (Zombie ptr bits (Suc n)) \<or> (\<forall>cap. restr ptra st cap)
 2. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>ptra. (is_nondevice_page_cap (Zombie ptr bits (Suc n)) \<or> Zombie ptr bits (Suc n) = NullCap) \<and> valid_ipc_buffer_cap (Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap c ptra
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s c. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>ptra. (is_nondevice_page_cap (Zombie ptr bits (Suc n)) \<or> Zombie ptr bits (Suc n) = NullCap) \<and> valid_ipc_buffer_cap (Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap c ptra
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> tcb_at ptr s \<longrightarrow> replicate (zombie_cte_bits bits) False \<noteq> tcb_cnode_index 2
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s
 3. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_objs s
 4. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 6. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 7. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> zombie_cte_bits bits < word_bits
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s
 3. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_objs s
 4. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 6. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 7. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; s \<turnstile> Zombie ptr bits (Suc n); cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) 0) s\<rbrakk> \<Longrightarrow> valid_reply_masters s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; emptyable slot s; halted_if_tcb ptr s; (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_wp_at (\<lambda>_. True) slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>c. tcb_cap_valid c slot s) \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) (ptr, replicate (zombie_cte_bits bits) False) s \<and> cte_wp_at (\<lambda>c. \<not> is_master_reply_cap c) slot s \<and> emptyable (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s proof (prove)
goal:
No subgoals! proof (state)
this:
s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x n. \<lbrakk>x < Suc n; x \<noteq> n\<rbrakk> \<Longrightarrow> x < n proof (state)
this:
\<lbrakk>?x < Suc ?n; ?x \<noteq> ?n\<rbrakk> \<Longrightarrow> ?x < ?n

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (state)
this:
(Inr ?rv, ?st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> ?st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall ?rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall ?rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall ?rv False)) and (\<lambda>s. case CTEDeleteCall ?rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall ?rv False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case CTEDeleteCall ?rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall ?rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> st \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (CTEDeleteCall rv False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (CTEDeleteCall rv False) \<lbrace>\<lambda>rva s. Q s \<and> invs s \<and> (case CTEDeleteCall rv False of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rva \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rva \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rva) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (CTEDeleteCall rv False)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>) \<Longrightarrow> s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>a. Q a \<and> invs a \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (Zombie ptr bits (Suc n)) a \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot a \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr a\<rbrace> doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = Zombie ptr bits (Suc n) then liftE (set_cap (Zombie ptr bits n) slot) else assertE (new_cap = NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace> proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'9\<rbrace> doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = Zombie ptr bits (Suc n) then liftE (set_cap (Zombie ptr bits n) slot) else assertE (new_cap = NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> emptyable slot s\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (3 subgoals):
 1. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rva s. (rva = Zombie ptr bits (Suc n) \<longrightarrow> Q s \<and> invs s \<and> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s) \<and> (rva \<noteq> Zombie ptr bits (Suc n) \<longrightarrow> (rva = NullCap \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s) \<and> ((\<exists>r b n. rva = Zombie r b n) \<and> first_cslot_of rva = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s))\<rbrace>
 2. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 3. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s. \<lbrakk>(Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s); Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rva) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrakk> \<Longrightarrow> (rva = Zombie ptr bits (Suc n) \<longrightarrow> Q s \<and> invs s \<and> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s) \<and> (rva \<noteq> Zombie ptr bits (Suc n) \<longrightarrow> (rva = NullCap \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s) \<and> ((\<exists>r b n. rva = Zombie r b n) \<and> first_cslot_of rva = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s))
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rva) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot \<Longrightarrow> (rva = Zombie ptr bits (Suc n) \<longrightarrow> Q s \<and> invs s \<and> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s) \<and> (rva \<noteq> Zombie ptr bits (Suc n) \<longrightarrow> (rva = NullCap \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s) \<and> ((\<exists>r b n. rva = Zombie r b n) \<and> first_cslot_of rva = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> Q s \<and> invs s \<and> emptyable slot s))
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>rva s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = rva) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (rva = Zombie ptr bits (Suc n) \<longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s) \<and> (rva \<noteq> Zombie ptr bits (Suc n) \<longrightarrow> (rva = NullCap \<longrightarrow> emptyable slot s) \<and> ((\<exists>r b n. rva = Zombie r b n) \<and> first_cslot_of rva = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> emptyable slot s))
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>rva s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = rva) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; \<not> is_master_reply_cap rva \<longrightarrow> emptyable slot s\<rbrakk> \<Longrightarrow> (rva = Zombie ptr bits (Suc n) \<longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s) \<and> (rva \<noteq> Zombie ptr bits (Suc n) \<longrightarrow> (rva = NullCap \<longrightarrow> emptyable slot s) \<and> ((\<exists>r b n. rva = Zombie r b n) \<and> first_cslot_of rva = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> emptyable slot s))
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s\<rbrakk> \<Longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; cte_wp_at (\<lambda>cap. is_final_cap' cap s) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (replaceable s slot (Zombie ptr bits n)) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; cap = NullCap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> (\<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot) \<and> (tcb_cap_valid (Zombie ptr bits (Suc n)) slot s \<longrightarrow> tcb_cap_valid (Zombie ptr bits n) slot s) \<and> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> (tcb_cap_valid (Zombie ptr bits (Suc n)) slot s \<longrightarrow> tcb_cap_valid (Zombie ptr bits n) slot s) \<and> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> tcb_cap_valid (Zombie ptr bits (Suc n)) slot s \<longrightarrow> tcb_cap_valid (Zombie ptr bits n) slot s
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 3. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 4. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 7. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 8. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> (\<forall>(get, set, restr)\<in>ran tcb_cap_cases. \<forall>ptra st. restr ptra st (Zombie ptr bits (Suc n)) \<longrightarrow> restr ptra st (Zombie ptr bits n)) \<and> (\<forall>ptra. valid_ipc_buffer_cap (Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap (Zombie ptr bits n) ptra)
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 3. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 4. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 7. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 8. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 2. \<And>s. \<lbrakk>Q s; invs s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap; no_cap_to_obj_with_diff_ref (Zombie ptr bits (Suc n)) {} s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 3. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 4. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 7. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 8. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap; no_cap_to_obj_with_diff_ref (Zombie ptr bits (Suc n)) {} s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (Zombie ptr bits n) {slot} s
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap\<rbrakk> \<Longrightarrow> \<forall>b. length b = zombie_cte_bits bits \<and> unat (of_bl b) < Suc n \<and> (length b = zombie_cte_bits bits \<longrightarrow> \<not> unat (of_bl b) < n) \<longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap; length b = zombie_cte_bits bits; unat (of_bl b) < Suc n; \<not> unat (of_bl b) < n\<rbrakk> \<Longrightarrow> ((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some NullCap; length b = zombie_cte_bits bits; \<not> (((ptr, b) \<noteq> slot \<longrightarrow> cte_wp_at ((=) NullCap) (ptr, b) s) \<and> (ptr, b) \<noteq> slot)\<rbrakk> \<Longrightarrow> unat (of_bl b) \<noteq> n
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; (ptr, b) \<noteq> slot \<and> \<not> cte_wp_at ((=) NullCap) (ptr, b) s \<or> (ptr, b) = slot; n = unat (of_bl b)\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) \<noteq> slot \<and> \<not> cte_wp_at ((=) NullCap) (ptr, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) \<noteq> slot; caps_of_state s (ptr, b) \<noteq> Some NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) \<noteq> slot; caps_of_state s (ptr, b) \<noteq> Some NullCap\<rbrakk> \<Longrightarrow> caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) \<noteq> Some NullCap
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (8 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (length b) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; n = unat (of_bl b); (ptr, b) \<noteq> slot; caps_of_state s (ptr, b) \<noteq> Some NullCap; zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> length b < 32
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (length b) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; n = unat (of_bl b); (ptr, b) \<noteq> slot; caps_of_state s (ptr, b) \<noteq> Some NullCap; zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> caps_of_state s (ptr, b) \<noteq> Some NullCap
 3. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 4. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 5. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 6. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 7. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 8. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (length b) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; n = unat (of_bl b); (ptr, b) \<noteq> slot; caps_of_state s (ptr, b) \<noteq> Some NullCap; zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> caps_of_state s (ptr, b) \<noteq> Some NullCap
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) slot s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); (ptr, b) = slot\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s (ptr, b) = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> replicate (zombie_cte_bits bits) False \<noteq> b; emptyable (ptr, b) s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) (ptr, b) s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) (unat (of_bl b))) = Some NullCap; length b = zombie_cte_bits bits; n = unat (of_bl b); slot = (ptr, b)\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s (ptr, b) = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> replicate (length b) False \<noteq> b; emptyable (ptr, b) s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) (ptr, b) s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, nat_to_cref (length b) (unat (of_bl b))) = Some NullCap; n = unat (of_bl b); slot = (ptr, b); zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (7 subgoals):
 1. \<And>s b. \<lbrakk>n = unat (of_bl b); slot = (ptr, b); zombie_cte_bits bits = length b; Q s; invs s; caps_of_state s (ptr, b) = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> replicate (length b) False \<noteq> b; emptyable (ptr, b) s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) (ptr, b) s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s\<rbrakk> \<Longrightarrow> length b < 32
 2. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s (ptr, b) = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> replicate (length b) False \<noteq> b; emptyable (ptr, b) s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) (ptr, b) s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, b) = Some NullCap; n = unat (of_bl b); slot = (ptr, b); zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> False
 3. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 4. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 5. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 6. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 7. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s b. \<lbrakk>Q s; invs s; caps_of_state s (ptr, b) = Some (Zombie ptr bits (Suc (unat (of_bl b)))); 0 < unat (of_bl b) \<or> replicate (length b) False \<noteq> b; emptyable (ptr, b) s; s \<turnstile> Zombie ptr bits (Suc (unat (of_bl b))); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc (unat (of_bl b))))) (ptr, b) s; is_final_cap' (Zombie ptr bits (Suc (unat (of_bl b)))) s; caps_of_state s (ptr, b) = Some NullCap; n = unat (of_bl b); slot = (ptr, b); zombie_cte_bits bits = length b\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s cap. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some cap; (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s a b r ba na. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie r ba na); (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs (Zombie r ba na); cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c \<noteq> {}) (a, b) s; \<forall>cref'. cte_wp_at (\<lambda>_. True) cref' s \<and> cref' \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c = {}) cref' s\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s a b r ba na. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie r ba na); (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs (Zombie r ba na); cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c \<noteq> {}) (a, b) s; \<forall>cref'. cte_wp_at (\<lambda>_. True) cref' s \<and> cref' \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c = {}) cref' s; cte_wp_at (\<lambda>_. True) slot s \<and> slot \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c = {}) slot s\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s a b r ba na. \<lbrakk>Q s; invs s; caps_of_state s slot = Some (Zombie ptr bits (Suc n)); 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie r ba na); (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs (Zombie r ba na); cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c \<noteq> {}) (a, b) s; cte_wp_at (\<lambda>_. True) slot s \<and> slot \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c = {}) slot s; cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>c. gen_obj_refs (Zombie ptr bits (Suc n)) \<inter> gen_obj_refs c = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s\<rbrakk> \<Longrightarrow> replaceable s slot (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie ptr bits (Suc n)); 0 < n; emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; slot = (ptr, nat_to_cref (zombie_cte_bits bits) n); replicate (zombie_cte_bits bits) False = nat_to_cref (zombie_cte_bits bits) n\<rbrakk> \<Longrightarrow> replaceable s (ptr, nat_to_cref (zombie_cte_bits bits) n) (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie ptr bits (Suc n)); 0 < n; emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; slot = (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrakk> \<Longrightarrow> n < Suc n
 2. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie ptr bits (Suc n)); 0 < n; emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; slot = (ptr, nat_to_cref (zombie_cte_bits bits) n); n = 0\<rbrakk> \<Longrightarrow> replaceable s (ptr, nat_to_cref (zombie_cte_bits bits) n) (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 3. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 4. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 5. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 6. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; caps_of_state s (ptr, nat_to_cref (zombie_cte_bits bits) n) = Some (Zombie ptr bits (Suc n)); 0 < n; emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; slot = (ptr, nat_to_cref (zombie_cte_bits bits) n); n = 0\<rbrakk> \<Longrightarrow> replaceable s (ptr, nat_to_cref (zombie_cte_bits bits) n) (Zombie ptr bits n) (Zombie ptr bits (Suc n))
 2. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 3. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 4. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 5. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>Q s; invs s; cte_wp_at (\<lambda>cap. cap = Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>cap. cap = NullCap \<or> (\<exists>r b n. cap = Zombie r b n) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; emptyable slot s; s \<turnstile> Zombie ptr bits (Suc n); ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap (Zombie ptr bits n)) slot s \<and> s \<turnstile> Zombie ptr bits n \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 3. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 4. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (3 subgoals):
 1. \<And>rv s''. (Inr rv, s'') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s) \<Longrightarrow> \<lbrace>?B13 rv\<rbrace> get_cap slot \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = rv) slot s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>
 2. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?B13\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 3. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> True \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> \<not> False \<and> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> \<not> cap_removeable (Zombie ptr bits (Suc n)) slot\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'9\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. (Q s \<and> invs s) \<and> cte_wp_at (\<lambda>cap. cap = NullCap \<or> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P'9 s proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P444\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>cap. cap = NullCap \<or> is_zombie cap \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs cap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)\<rbrace>, -
 2. s \<turnstile> \<lbrace>?P'444\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. Q s \<and> invs s\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 3. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> ?P444 s \<and> ?P'444 s proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'444\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. Q s \<and> invs s\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (True \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)) \<and> ?P'444 s proof (prove)
goal (3 subgoals):
 1. s \<turnstile> \<lbrace>?P'444\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?Q'454\<rbrace>, \<lbrace>\<lambda>rv a. Q a \<and> invs a\<rbrace>
 2. \<And>s r. ?Q'454 s r \<Longrightarrow> Q r \<and> invs r
 3. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (True \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)) \<and> ?P'444 s proof (prove)
goal (3 subgoals):
 1. (Inr (ptr, nat_to_cref (zombie_cte_bits bits) n), s) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s)
 2. \<And>s r. Q r \<and> invs r \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) r \<Longrightarrow> Q r \<and> invs r
 3. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (True \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)) \<and> (((Q s \<and> invs s) \<and> valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s) \<and> (\<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s)) \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s proof (prove)
goal (2 subgoals):
 1. \<And>s r. Q r \<and> invs r \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) r \<Longrightarrow> Q r \<and> invs r
 2. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (True \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)) \<and> (((Q s \<and> invs s) \<and> valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s) \<and> (\<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s)) \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s proof (prove)
goal (1 subgoal):
 1. Q s \<and> invs s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot) \<and> halted_if_tcb ptr s \<Longrightarrow> (True \<and> (0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot)) \<and> (((Q s \<and> invs s) \<and> valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s) \<and> (\<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s)) \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Q s; invs s; cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); emptyable slot s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); emptyable slot s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> n < Suc n
 2. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); emptyable slot s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> cap_irqs (Zombie ptr bits (Suc n)) = {} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Q s; invs s; is_final_cap' (Zombie ptr bits (Suc n)) s; is_zombie (Zombie ptr bits (Suc n)); emptyable slot s; 0 < n \<or> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> cap_irqs (Zombie ptr bits (Suc n)) = {} proof (prove)
goal:
No subgoals! proof (state)
this:
s \<turnstile> \<lbrace>Q and invs and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)\<rbrace> rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<lbrace>\<lambda>rv s. Q s \<and> invs s \<and> (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall prod bool \<Rightarrow> True | FinaliseSlotCall sl x \<Rightarrow> (fst rv \<or> x \<longrightarrow> cte_wp_at (replaceable s sl NullCap) sl s) \<and> (snd rv \<noteq> NullCap \<longrightarrow> post_cap_delete_pre (snd rv) ((caps_of_state s)(sl \<mapsto> NullCap))) | ReduceZombieCall cap sl x \<Rightarrow> \<not> x \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) sl s) \<and> emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s\<rbrace>, \<lbrace>\<lambda>rv. Q and invs\<rbrace>

goal:
No subgoals!