theory CSpace_C

lemma cteSwap_ccorres:
  "ccorres dc xfdc
          (cte_at' slot  and cte_at' slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot'))
          (UNIV \<inter> {s. slot1_' s = Ptr slot}
              \<inter> {s. slot2_' s = Ptr slot'}
              \<inter> {s. ccap_relation cap1 (cap1_' s)}
              \<inter> {s. ccap_relation cap2 (cap2_' s)})
          []
          (cteSwap cap1 slot cap2 slot')
          (Call cteSwap_'proc)" apply (cinit (no_ignore_call) lift: slot1_' slot2_' cap1_' cap2_' simp del: return_bind)
  (* the previous line stands for all the following:
  unfolding cteSwap_def
  apply (rule ccorres_Call)
  apply (rule cteSwap_impl [unfolded cteSwap_body_def])
  apply (rule ccorres_rhs_assoc)+
  apply (simp del: return_bind Int_UNIV_left)
  apply (cinitlift slot1_' slot2_' cap1_' cap2_')

  apply (erule ssubst)+
  apply (rule ccorres_guard_imp2) -- "We will need the abstract guards to solve the conc. guard obligations"
*)

  \<comment> \<open>Start proofs\<close>

  \<comment> \<open>***Main goal***\<close>
  \<comment> \<open>--- instruction: cte1 \<leftarrow> getCTE slot;              ---\<close>
  \<comment> \<open>---              y \<leftarrow> updateCap slot cap2          ---\<close>
  \<comment> \<open>---              y \<leftarrow> updateCap slot' cap1;        ---\<close>
  \<comment> \<open>---              mdb1 \<leftarrow> return (cteMDBNode cte1); ---\<close>


  \<comment> \<open>Start proofs\<close> apply (ctac (no_vcg) pre: ccorres_pre_getCTE
     add: ccorres_return_cte_mdbnode_safer [where ptr="slot"])+

     \<comment> \<open>generates maingoal + 2 subgoals (Haskell pre/post and C pre/post) for each instruction (except getCTE)\<close>

   \<comment> \<open>***Main Goal***\<close>
   \<comment> \<open>--- instruction: y <- updateMDB (mdbPrev rvc) (mdbNext_update (%_. slot')) ---\<close> apply csymbr apply csymbr
         \<comment> \<open>added by sjw \<dots>\<close> apply (erule_tac t = ret__unsigned in ssubst) apply (ctac (no_vcg) add: updateMDB_mdbPrev_set_mdbNext) apply csymbr apply csymbr apply (erule_tac t = ret__unsigned in ssubst) apply (ctac (no_vcg) add: updateMDB_mdbNext_set_mdbPrev) apply (rule ccorres_move_c_guard_cte) apply (ctac (no_vcg) pre: ccorres_getCTE
               add: ccorres_return_cte_mdbnode [where ptr = slot'])+ apply csymbr apply csymbr apply (erule_tac t = ret__unsigned in ssubst) apply (ctac (no_vcg) add: updateMDB_mdbPrev_set_mdbNext) apply csymbr apply csymbr apply (erule_tac t = ret__unsigned in ssubst) apply (ctac (no_vcg) add: updateMDB_mdbNext_set_mdbPrev)
(*
         apply (rule ccorres_split_nothrow [where xf'=xfdc])
         -- "***the correspondance proof for 1st instruction***"
             apply (erule_tac t = prev_ptr in ssubst)
             apply (rule updateMDB_mdbPrev_set_mdbNext, rule refl, assumption)

         -- "***the ceqv proof***"
             apply ceqv

         -- "***the correspondance proof for the rest***"
         -- "--- instruction: updateMDB (mdbNext rvc) (mdbPrev_update (%_. slot'))  ---"
           apply csymbr
           apply (rule ccorres_split_nothrow [where xf'=xfdc])
           -- "***the correspondance proof for 1st instruction***"
               apply (erule_tac t = next_ptr in ssubst)
               apply (rule updateMDB_mdbNext_set_mdbPrev, rule refl, assumption)

           -- "***the ceqv proof***"
               apply ceqv

           -- "***the correspondance proof for the rest***"
           -- "--- instruction: cte2 \<leftarrow> getCTE slot';              ---"
           -- "---              mdb2 \<leftarrow> return (cteMDBNode cte2);  ---"
           -- "---              y <- updateMDB slot (const mdb2);  ---"
           -- "---              y <- updateMDB slot' (const rvc);  ---"
             apply (ctac pre: ccorres_getCTE)+
                        -- "generates maingoal + 2 subgoals (Haskell pre/post and C pre/post) for each instruction (except getCTE)"
             -- "Main Goal"
             -- "---instruction:  y <- updateMDB (mdbPrev mdb2) (mdbNext_update (%_. slot)) --"
                   apply csymbr
                   apply (rule ccorres_split_nothrow [where xf'=xfdc])
                   -- "***the correspondance proof for 1st instruction***"
                       apply (erule_tac t = prev_ptr in ssubst)
                       apply (rule updateMDB_mdbPrev_set_mdbNext, rule refl, assumption)

                   -- "***the ceqv proof***"
                        apply ceqv

                   -- "***the correspondance proof for the rest***"
                   -- "--- instruction: updateMDB (mdbNext rvg) (mdbPrev_update (%_. slot)) ---"
                     apply csymbr
                     apply (erule_tac t = next_ptr in ssubst)
                     apply (rule updateMDB_mdbNext_set_mdbPrev, rule refl, assumption)
*)
                    \<comment> \<open>***Haskell pre/post for updateMDB (mdbPrev rvg) (mdbNext_update (%_. slot))\<close> apply wp
                   \<comment> \<open>***C       pre/post for updateMDB (mdbPrev rvg) (mdbNext_update (%_. slot))\<close> apply simp
                  \<comment> \<open>***Haskell pre/post for updateMDB slot' (const rvc)\<close> apply wp
                 \<comment> \<open>***C       pre/post for updateMDB slot' (const rvc)\<close> apply simp
                \<comment> \<open>***Haskell pre/post for updateMDB slot (const mdb2)\<close> apply wp
               \<comment> \<open>***C       pre/post for updateMDB slot (const mdb2)\<close> apply simp
              \<comment> \<open>***Haskell pre/post for return (cteMDBNode cte2) ***\<close> apply wp
             \<comment> \<open>***C       pre/post for return (cteMDBNode cte2) ***\<close> apply simp
           \<comment> \<open>***Haskell pre/post for updateMDB (mdbPrev rvc) (mdbPrev_update (%_. slot'))\<close> apply (clarsimp simp : cte_wp_at_ctes_of) apply wp
           \<comment> \<open>***C       pre/post for updateMDB (mdbPrev rvc) (mdbPrev_update (%_. slot'))\<close> apply simp
         \<comment> \<open>***Haskell pre/post for updateMDB (mdbPrev rvc) (mdbNext_update (%_. slot'))\<close> apply wp
         \<comment> \<open>***C       pre/post for updateMDB (mdbPrev rvc) (mdbNext_update (%_. slot'))\<close> apply simp
   \<comment> \<open>***Haskell pre/post for return (cteMDBNode cte1) ***\<close> apply wp
   \<comment> \<open>***C       pre/post for return (cteMDBNode cte1) ***\<close> apply simp
   \<comment> \<open>***Haskell pre/post for (updateCap slot' cap1) ***\<close> apply (clarsimp simp : cte_wp_at_ctes_of) apply (wp updateCap_ctes_of_wp)




   \<comment> \<open>***C       pre/post for (updateCap slot' cap1) ***\<close> apply simp
   \<comment> \<open>***Haskell pre/post for (updateCap slot cap2) ***\<close> apply (clarsimp simp : cte_wp_at_ctes_of) apply (wp updateCap_ctes_of_wp)
   \<comment> \<open>***C       pre/post for (updateCap slot cap2) ***\<close> apply simp



  \<comment> \<open>********************\<close>
  \<comment> \<open>*** LAST SUBGOAL ***\<close>
  \<comment> \<open>********************\<close>
  \<comment> \<open>***conjunction of generalised precondition ***\<close> apply (rule conjI)

  \<comment> \<open>***--------------------------------***\<close>
  \<comment> \<open>***Haskell generalised precondition***\<close>
  \<comment> \<open>***--------------------------------***\<close> apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule (2) is_aligned_3_prev [where p = slot]) apply (frule (2) is_aligned_3_next [where p = slot]) apply simp apply (intro conjI impI)

  \<comment> \<open>\<exists>cte'. modify_map (\<dots>) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte'\<close> apply (simp add: modify_map_if) apply (case_tac ctea) apply simp apply (cases "(slot'=slot)", simp+)
    \<comment> \<open>no_0 (ctes_of s)\<close> apply (simp add: valid_mdb'_def) apply (erule valid_mdb_ctesE) apply assumption

  \<comment> \<open>\<forall>cte. modify_map (modify_map \<dots>) slot' = Some cte \<longrightarrow> \<dots>\<close> apply (rule allI) apply (rule impI)
   \<comment> \<open>modify_map (modify_map \<dots>) (?P3540 \<dots>) = Some cte\<close>
   \<comment> \<open>\<dots>\<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea) \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3\<close>
   \<comment> \<open>Important: we need the first part to prove the second \<Longrightarrow> we need conj_cong\<close> apply (clarsimp simp: modify_map_if cong: if_cong split: if_split_asm) apply (erule disjE) apply clarsimp apply clarsimp apply (drule (2) is_aligned_3_next) apply simp apply (erule disjE) apply clarsimp apply (drule (2) is_aligned_3_prev) apply simp apply clarsimp apply (frule (2) is_aligned_3_prev) apply (frule (2) is_aligned_3_next) apply simp

  \<comment> \<open>***--------------------------***\<close>
  \<comment> \<open>***C generalised precondition***\<close>
  \<comment> \<open>***--------------------------***\<close> apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) (UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>ccap_relation cap1 \<acute>cap1\<rbrace> \<inter> \<lbrace>ccap_relation cap2 \<acute>cap2\<rbrace>) [] (cteSwap cap1 slot cap2 slot') (Call cteSwap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a slot2 slot1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2283 cap2a cap1a slot2 slot1) (?Q'2283 cap2a cap1a slot2 slot1) [SKIP] (do cte1 <- getCTE slot;
y <- updateCap slot cap2;
y <- updateCap slot' cap1;
mdb1 <- return (cteMDBNode cte1);
y <- updateMDB (mdbPrev mdb1) (mdbNext_update (\<lambda>_. slot'));
y <- updateMDB (mdbNext mdb1) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const mdb1);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slot1\<rightarrow>[''cap_C''])) cap2a)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slot2\<rightarrow>[''cap_C''])) cap1a)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>mdb1 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb1);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))))))))))))))
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2283 cap2a cap1a slot2 slot1 s \<and> s' \<in> ?Q'2283 cap2a cap1a slot2 slot1 proof (prove)
goal (8 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv) (?Q'2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1) [SKIP] (do y <- updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot'));
y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(mdb1);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv (mdb1_' s)
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; ret__unsigned = mdbPrev_CL (mdb_node_lift mdb1)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv) (?G'2800 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned) [SKIP] (do y <- updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot'));
y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>prev_ptr :== ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2800 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv (mdb1_' s) v}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; ret__unsigned = mdbPrev_CL (mdb_node_lift mdb1)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv) (?G'2971 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned) [SKIP] (do y <- updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot'));
y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (IF ret__unsigned \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_ptr_'_update (\<lambda>_. v) sa \<in> ?G'2971 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv (mdb1_' s) v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv) (?G'3267 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned (mdbPrev_CL (mdb_node_lift mdb1))) [SKIP] (do y <- updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot'));
y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (IF mdbPrev_CL (mdb_node_lift mdb1) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev_CL (mdb_node_lift mdb1))} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr (mdbPrev_CL (mdb_node_lift mdb1))\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>?Q2348 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_ptr_'_update (\<lambda>_. v) sa \<in> ?G'3267 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv (mdb1_' s) v v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva xfdcc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva) (?Q'3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva xfdcc) [SKIP] (do y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb1);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva (xfdc s)
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; ret__unsigned = mdbNext_CL (mdb_node_lift mdb1)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva) (?G'3310 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned) [SKIP] (do y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>next_ptr :== ret__unsigned;;
(IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3310 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva (xfdc s) v}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; ret__unsigned = mdbNext_CL (mdb_node_lift mdb1)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva) (?G'3521 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned) [SKIP] (do y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (IF ret__unsigned \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. next_ptr_'_update (\<lambda>_. v) sa \<in> ?G'3521 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva (xfdc s) v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (10 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva) (?G'3803 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned (mdbNext_CL (mdb_node_lift mdb1))) [SKIP] (do y <- updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot'));
cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (IF mdbNext_CL (mdb_node_lift mdb1) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift mdb1))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift mdb1))\<rightarrow>[''cteMDBNode_C'']),ptr_val slot2))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>?Q3273 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. next_ptr_'_update (\<lambda>_. v) sa \<in> ?G'3803 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned rva (xfdc s) v v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (12 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3809 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb) (?Q'3809 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd) [SKIP] (do cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>?Q3809 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3809 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb (xfdc s)
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3845 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb) (?C'3844 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd) [SKIP] (do cte2 <- getCTE slot';
mdb2 <- return (cteMDBNode cte2);
y <- updateMDB slot (const mdb2);
y <- updateMDB slot' (const rv);
y <- updateMDB (mdbPrev mdb2) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext mdb2) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>mdb2 :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C'']));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot1\<rightarrow>[''cteMDBNode_C''])) \<acute>mdb2)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot2} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slot2\<rightarrow>[''cteMDBNode_C''])) mdb1)));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. ?A3845 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?C'3844 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb (xfdc s) \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce yc) (?Q'4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf) [SKIP] (do y <- updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(mdb2);;
(\<acute>prev_ptr :== \<acute>ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce rvd (xfdc s)
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; ret__unsigned = mdbPrev_CL (mdb_node_lift mdb2)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc) (?G'4177 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned) [SKIP] (do y <- updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))
od) (\<acute>prev_ptr :== ret__unsigned;;
(IF \<acute>prev_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (prev_ptr_' s)} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr \<acute>prev_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4177 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce rvd (xfdc s) v}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; ret__unsigned = mdbPrev_CL (mdb_node_lift mdb2)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc) (?G'4311 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned) [SKIP] (do y <- updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))
od) (IF ret__unsigned \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_ptr_'_update (\<lambda>_. v) sa \<in> ?G'4311 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce rvd (xfdc s) v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc) (?G'4472 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned (mdbPrev_CL (mdb_node_lift mdb2))) [SKIP] (do y <- updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot));
updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))
od) (IF mdbPrev_CL (mdb_node_lift mdb2) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev_CL (mdb_node_lift mdb2))} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr (mdbPrev_CL (mdb_node_lift mdb2))\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>?Q4143 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_ptr_'_update (\<lambda>_. v) sa \<in> ?G'4472 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce rvd (xfdc s) v v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd xfdcg. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd xfdcg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd) (?Q'4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd xfdcg) [SKIP] (updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(mdb2);;
(\<acute>next_ptr :== \<acute>ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI))
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc\<rbrace> updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot)) \<lbrace>?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd (xfdc s)
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and ?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd xfdcg; ret__unsigned = mdbNext_CL (mdb_node_lift mdb2)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd) (?G'4520 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned) [SKIP] (updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))) (\<acute>next_ptr :== ret__unsigned;;
IF \<acute>next_ptr \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (next_ptr_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>next_ptr\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc\<rbrace> updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot)) \<lbrace>?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4520 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd (xfdc s) v}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and ?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd xfdcg; ret__unsigned = mdbNext_CL (mdb_node_lift mdb2)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd) (?G'4611 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned) [SKIP] (updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))) (IF ret__unsigned \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc\<rbrace> updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot)) \<lbrace>?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. next_ptr_'_update (\<lambda>_. v) sa \<in> ?G'4611 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd (xfdc s) v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and ?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd xfdcg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd) (?G'4683 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsignedc rvd xfdcg ret__unsigned (mdbNext_CL (mdb_node_lift mdb2))) [SKIP] (updateMDB (mdbNext rvc) (mdbPrev_update (\<lambda>_. slot))) (IF mdbNext_CL (mdb_node_lift mdb2) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift mdb2))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift mdb2))\<rightarrow>[''cteMDBNode_C'']),ptr_val slot1))
FI)
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc\<rbrace> updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot)) \<lbrace>?Q4478 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. next_ptr_'_update (\<lambda>_. v) sa \<in> ?G'4683 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned rvd (xfdc s) v v}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and ?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc\<rbrace> updateMDB (mdbPrev rvc) (mdbNext_update (\<lambda>_. slot)) \<lbrace>\<lambda>a b. is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and ?R4482 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc a\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsignedb rvb xfdcd cte2 rvc mdb2 yb xfdce yc xfdcf ret__unsigned s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc yc xfdcf; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and (\<lambda>a. is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3))\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb\<rbrace> updateMDB slot' (const rv) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and (\<lambda>a. is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3))\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and ?R4145 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2 yb and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 yb xfdce s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc yb xfdce; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb2) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and (\<lambda>a. (is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc mdb2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc mdb2\<rbrakk> \<Longrightarrow> \<lbrace>?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc\<rbrace> updateMDB slot (const rvc) \<lbrace>\<lambda>yb. (\<lambda>_. slot' \<noteq> 0) and (\<lambda>a. (is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and ?R4110 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 rvc and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdcd cte2 rvc mdb2 s rvd. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdcd; cmdbnode_relation rvc mdb2; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rv mdb1\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and (\<lambda>s. slot' \<noteq> 0 \<and> ((is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slot2) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb cte2\<rbrace> return (cteMDBNode cte2) \<lbrace>\<lambda>rvc. (\<lambda>_. slot \<noteq> 0) and (\<lambda>s. slot' \<noteq> 0 \<and> ((is_aligned (mdbPrev rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext rvc) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slot2) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ?R3856 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned rvb cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned rvb xfdc cte2 s rvc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb xfdc; cmdbnode_relation rvc (mdb2_' s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>cmdbnode_relation rvc \<^bsup>s\<^esup>mdb2\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ((\<lambda>_. slot \<noteq> 0) and (\<lambda>s. slot' \<noteq> 0 \<and> ((is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slot2) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1))) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdc ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> ((\<lambda>a. ctes_of a slot' = Some cte) and ((\<lambda>_. slot \<noteq> 0) and (\<lambda>s. slot' \<noteq> 0 \<and> ((is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slot2) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1))) s) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap2a cap1a cte1 xfdca xfdcb rv mdb1 ret__unsigneda. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3813 cap2a cap1a (cte_Ptr slot') (cte_Ptr slot) cte1 () xfdca () xfdcb rv mdb1 ret__unsigneda ()\<rbrace> updateMDB (mdbNext rv) (mdbPrev_update (\<lambda>_. slot')) \<lbrace>\<lambda>rvb. (\<lambda>s. \<forall>cte. ctes_of s slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. ctes_of s slot = Some cte)) and (\<lambda>s. \<exists>cte. ctes_of s slot' = Some cte)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3813 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned a\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigneda rva xfdcc ret__unsigned s rvb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva xfdcc; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot') = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val slot2 = slot'\<rbrace>} \<inter> \<lbrace>True\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>a. no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 10. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (9 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv mdb1 ret__unsigned. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv mdb1\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc rv\<rbrace> updateMDB (mdbPrev rv) (mdbNext_update (\<lambda>_. slot')) \<lbrace>\<lambda>a. (\<lambda>a. is_aligned (mdbNext rv) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>a. no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) (mdbNext rv) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and ?R3277 cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc a\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 9. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (8 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdcb rv mdb1 ret__unsigned s rva. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdcb; cmdbnode_relation rv mdb1; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>b. (is_aligned (mdbNext a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) \<and> no_0 (ctes_of b) \<and> no_0 (ctes_of b) \<and> (\<forall>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 8. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (7 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2351 cap2a cap1a slot2 slot1 cte1 y xfdca ya\<rbrace> return (cteMDBNode cte1) \<lbrace>\<lambda>a. (\<lambda>b. is_aligned (mdbPrev a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>b. (is_aligned (mdbNext a) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) \<and> no_0 (ctes_of b) \<and> no_0 (ctes_of b) \<and> (\<forall>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (modify_map (ctes_of b) (mdbPrev a) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext a) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ?R2351 cap2a cap1a slot2 slot1 cte1 y xfdc ya and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 7. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (6 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca ya xfdc s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc ya xfdc; cmdbnode_relation rv (mdb1_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb1_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. prev_ptr_'_update (\<lambda>_. v) s \<in> UNIV}}
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>a. (is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) \<and> no_0 (ctes_of a) \<and> no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 6. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (5 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdc. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a slot2 slot1 cte1 y\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) and (\<lambda>a. (is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3)) \<and> no_0 (ctes_of a) \<and> no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot = Some cte)) \<and> (\<exists>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte))) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (5 subgoals):
 1. \<And>cap2a cap1a cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 cap2a cap1a (cte_Ptr slot') (cte_Ptr slot) cte1 ()\<rbrace> updateCap slot' cap1 \<lbrace>\<lambda>ya. (\<lambda>a. \<exists>cte'. ctes_of a slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') and (\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (modify_map (ctes_of a) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. ctes_of a slot = Some cte)) \<and> (\<exists>cte. ctes_of a slot' = Some cte)) and (\<lambda>s. \<exists>cte. ctes_of s slot = Some cte)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R2321 cap2a cap1a slot2 slot1 cte1 y and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 5. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (4 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 y xfdca s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc y xfdca; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ptr_val slot1 = slot\<rbrace> \<inter> \<lbrace>True\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>a. (\<exists>cte'. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') \<and> (is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1))) \<and> (\<forall>cte. modify_map (modify_map (modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot' = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 4. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a slot2 slot1 cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>a. (\<exists>cte'. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') \<and> (is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1))) \<and> (\<forall>cte. modify_map (modify_map (modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot' = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot2)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a cte1. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a\<rbrakk> \<Longrightarrow> \<lbrace>?R2293 cap2a cap1a (cte_Ptr slot') (cte_Ptr slot) cte1\<rbrace> updateCap slot cap2 \<lbrace>\<lambda>y. (\<lambda>a. (\<exists>cte'. modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte1 = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte1)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (ctes_of a) \<and> (\<forall>cte. modify_map (modify_map (modify_map (ctes_of a) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte1)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte1)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. ctes_of a slot = Some cte)) \<and> (\<exists>cte. ctes_of a slot' = Some cte) \<and> (\<exists>cte. ctes_of a slot = Some cte)) and (\<lambda>s. \<exists>cte. ctes_of s slot' = Some cte)\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and ?R2293 cap2a cap1a slot2 slot1 cte and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 cte1 s rv. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>ccap_relation cap1 cap1a\<rbrace> \<inter> \<lbrace>slot2 = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>True\<rbrace>
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. ((\<exists>cte'. modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) \<and> (\<forall>ctea. modify_map (modify_map (modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some ctea \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (1 subgoal):
 1. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. ((\<exists>cte'. modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) \<and> (\<forall>ctea. modify_map (modify_map (modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some ctea \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. ((\<exists>cte'. modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode cte = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> is_aligned (mdbNext (cteMDBNode cte)) 3 \<and> (slot' \<noteq> 0 \<longrightarrow> is_aligned slot' 3) \<and> no_0 (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) \<and> (\<forall>ctea. modify_map (modify_map (modify_map (modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode cte)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some ctea \<longrightarrow> slot \<noteq> 0 \<and> slot' \<noteq> 0 \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> (slot \<noteq> 0 \<longrightarrow> is_aligned slot 3) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot = Some cte)) \<and> (\<exists>cte. modify_map (ctes_of a) slot (cteCap_update (\<lambda>_. cap2)) slot' = Some cte)) and cte_wp_at' (\<lambda>_. True) (ptr_val slot1)) s
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea\<rbrakk> \<Longrightarrow> (\<exists>cte'. modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> no_0 (ctes_of s) \<and> (\<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3)
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> (\<exists>cte'. modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> no_0 (ctes_of s) \<and> (\<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3)
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> (\<exists>cte'. modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte') \<and> is_aligned (mdbPrev (cteMDBNode ctea)) 3 \<and> is_aligned (mdbNext (cteMDBNode ctea)) 3 \<and> no_0 (ctes_of s) \<and> (\<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3)
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> (\<exists>cte'. modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte') \<and> no_0 (ctes_of s) \<and> (\<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3)
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (4 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<exists>cte'. modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1)) slot = Some cte' \<and> cteMDBNode ctea = cteMDBNode cte'
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 3. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 4. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (4 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>node. (\<exists>cap. ctea = CTE cap node) \<and> cte' = CTE cap2 node) \<and> cteMDBNode ctea = cteMDBNode cte'
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 3. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 4. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (4 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb x1 x2. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; ctea = CTE x1 x2\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>node. (\<exists>cap. ctea = CTE cap node) \<and> cte' = CTE cap2 node) \<and> cteMDBNode ctea = cteMDBNode cte'
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 3. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 4. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; slot' \<noteq> slot\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb_ctes (ctes_of s); pspace_aligned' s; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; slot' \<noteq> slot\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; pspace_aligned' s; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; slot' \<noteq> slot; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 (ctes_of s)
 2. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> \<forall>cte. modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3\<rbrakk> \<Longrightarrow> modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; modify_map (modify_map (modify_map (modify_map (ctes_of s) slot (cteCap_update (\<lambda>_. cap2))) slot' (cteCap_update (\<lambda>_. cap1))) (mdbPrev (cteMDBNode ctea)) (cteMDBNode_update (mdbNext_update (\<lambda>_. slot')))) (mdbNext (cteMDBNode ctea)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. slot'))) slot' = Some cte\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) nodea = node) \<and> CTE cap (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte; mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> CTE cap1 (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (4 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) nodea = node) \<and> CTE cap (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte; mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea)\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) nodea = node) \<and> CTE cap (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> CTE cap1 (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 4. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) nodea = node) \<and> CTE cap (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> CTE cap1 (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node) = cte\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea node cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some (CTE cap node); valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node = node\<rbrakk> \<Longrightarrow> is_aligned (mdbNext node) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea node cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbNext (cteMDBNode ctea)) = Some (CTE cap node); pspace_aligned' s; slot \<noteq> mdbNext (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; slot' = mdbNext (cteMDBNode ctea); mdbPrev (cteMDBNode ctea) = mdbNext (cteMDBNode ctea) \<longrightarrow> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode ctea)) node = node; is_aligned (mdbNext (cteMDBNode (CTE cap node))) 3\<rbrakk> \<Longrightarrow> is_aligned (mdbNext node) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot' \<or> cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; mdbPrev (cteMDBNode ctea) = slot'\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea nodea cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbPrev (cteMDBNode ctea)) = Some (CTE cap nodea); valid_mdb' s; pspace_aligned' s; slot \<noteq> mdbPrev (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> mdbPrev (cteMDBNode ctea); slot' = mdbPrev (cteMDBNode ctea)\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev nodea) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>cap2a cap1a s s' ctea nodea cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s (mdbPrev (cteMDBNode ctea)) = Some (CTE cap nodea); pspace_aligned' s; slot \<noteq> mdbPrev (cteMDBNode ctea); ctes_of s slot = Some ctea; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> mdbPrev (cteMDBNode ctea); slot' = mdbPrev (cteMDBNode ctea); is_aligned (mdbPrev (cteMDBNode (CTE cap nodea))) 3\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev nodea) 3
 2. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 3. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea cteb cte cap node. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some cteb; valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> cap1 = cap \<and> (\<exists>nodea. (\<exists>cap. cteb = CTE cap nodea) \<and> mdbNext_update (\<lambda>_. slot') nodea = node) \<and> cte = CTE cap node; cap = cap1 \<and> (\<exists>cap. cteb = CTE cap node) \<and> cte = CTE cap1 node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> is_aligned (mdbNext (cteMDBNode cte)) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea node cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some (CTE cap node); valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> mdbNext_update (\<lambda>_. slot') node = node\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev node) 3 \<and> is_aligned (mdbNext node) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea node cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some (CTE cap node); valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> mdbNext_update (\<lambda>_. slot') node = node; is_aligned (mdbPrev (cteMDBNode (CTE cap node))) 3\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev node) 3 \<and> is_aligned (mdbNext node) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>cap2a cap1a s s' ctea node cap. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; (s, s') \<in> rf_sr; ctes_of s slot' = Some (CTE cap node); valid_mdb' s; pspace_aligned' s; slot \<noteq> slot'; ctes_of s slot = Some ctea; is_aligned (mdbPrev (cteMDBNode ctea)) 3; is_aligned (mdbNext (cteMDBNode ctea)) 3; mdbNext (cteMDBNode ctea) \<noteq> slot'; mdbPrev (cteMDBNode ctea) = slot' \<longrightarrow> mdbNext_update (\<lambda>_. slot') node = node; is_aligned (mdbPrev (cteMDBNode (CTE cap node))) 3; is_aligned (mdbNext (cteMDBNode (CTE cap node))) 3\<rbrakk> \<Longrightarrow> is_aligned (mdbPrev node) 3 \<and> is_aligned (mdbNext node) 3
 2. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (1 subgoal):
 1. \<And>cap2a cap1a slot2 slot1 s s'. \<lbrakk>ccap_relation cap2 cap2a; ccap_relation cap1 cap1a; slot2 = cte_Ptr slot'; slot1 = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>_. True) slot and cte_wp_at' (\<lambda>_. True) slot' and valid_mdb' and pspace_aligned' and (\<lambda>_. slot \<noteq> slot')) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ccap_relation cap2 cap2a\<rbrace> \<inter> \<lbrace>slot1 = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal:
No subgoals!