theory CNode_DR

lemma cap_revoke_corres_helper:
  "dcorres boolean_exception (\<lambda>_. True)
      ((=) s' and invs and valid_pdpt_objs and valid_etcbs)
      (monadic_trancl_preemptible
         (\<lambda>y. do S \<leftarrow> gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
                 if S = {} then returnOk True
                 else do child \<leftarrow> select S;
                         cap \<leftarrow> KHeap_D.get_cap child;
                         doE y \<leftarrow> assertE (cap \<noteq> cdl_cap.NullCap);
                             y \<leftarrow> delete_cap child;
                             Monads_D.throw \<sqinter> returnOk False
                         odE
                      od
              od)
         False)
       (cap_revoke slot')
  " proof (induct rule: cap_revoke.induct) case (1 slot' sfix) show ?case supply if_cong[cong] apply (subst cap_revoke.simps) apply (rule monadic_rewrite_corres_l[where P =\<top>,simplified]) apply (rule Finalise_DR.monadic_trancl_preemptible_step) apply (rule dcorres_expand_pfx) apply (clarsimp simp:liftE_bindE) apply (rule_tac Q'="\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'" in corres_symb_exec_r) apply (rule dcorres_expand_pfx) apply (rule_tac Q'="\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix" in corres_symb_exec_r) apply clarsimp apply (rule dcorres_expand_pfx) apply clarsimp apply (case_tac "rv = cap.NullCap") apply (simp add:gets_def bindE_def bind_assoc whenE_def) apply (rule dcorres_absorb_get_l) apply (subst cdl_Null_descendants) apply (subst identity_eq, simp ) apply (drule invs_mdb, simp) apply (clarsimp simp:empty_set_eq)+ apply (clarsimp simp:returnOk_def lift_def) apply (rule corres_guard_imp) apply (rule monadic_rewrite_corres_l[where P=\<top> ,simplified]) apply (rule monadic_trancl_preemptible_return) apply (rule corres_trivial) apply (clarsimp simp:returnOk_def boolean_exception_def)+ apply (case_tac "CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}") apply (clarsimp simp:whenE_def empty_set_eq) apply (simp add:gets_def bindE_def bind_assoc whenE_def) apply (rule dcorres_absorb_get_l) apply (subst descendants_of_eqv) apply (drule invs_mdb_cte) apply (drule sym, force simp: swp_def) apply (rule cte_wp_at_weakenE) apply simp+ apply (clarsimp simp: lift_def empty_set_eq)+ apply (rule corres_guard_imp) apply (rule monadic_rewrite_corres_l[where P=\<top> ,simplified]) apply (rule monadic_trancl_preemptible_return) apply (rule corres_trivial) apply (clarsimp simp:returnOk_def boolean_exception_def)+ apply (clarsimp simp:whenE_def empty_set_eq) apply (subst gets_def) apply (simp add: bind_assoc bindE_def) apply (rule dcorres_absorb_get_l) apply (subst descendants_of_eqv) apply (drule invs_mdb_cte) apply (drule sym, force simp: swp_def) apply (rule cte_wp_at_weakenE, simp+) apply (clarsimp simp:bind_assoc) apply (rule corres_split_forwards'[where r'="\<lambda>slot slot'. slot = transform_cslot_ptr slot'"
             and Q =" \<lambda>r. \<top>" and Q'="\<lambda>r s. s = sfix \<and> r \<in> (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<and> (r, s) \<in> fst ((select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix))) sfix)"]) apply (rule corres_guard_imp[OF dcorres_select_select_ext]) apply (subst descendants_of_eqv) apply (drule invs_mdb_cte) apply (simp add: swp_def) apply (erule cte_wp_at_weakenE, simp) apply (simp,blast) apply simp+ apply (wp, (clarsimp simp: select_ext_def in_monad)+) apply (rule dcorres_expand_pfx) apply (rule_tac r'="\<lambda>cap cap'. cap = transform_cap cap'"
             and Q ="\<lambda>r. \<top>" and Q'="\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa,ba) s \<and> s = sfix" in corres_split_forwards') apply (rule corres_guard_imp[OF get_cap_corres],simp+) apply (case_tac "next_revoke_cap slot' sfix") apply clarsimp apply (frule(1) descendants_not_idle) apply (simp add:invs_def valid_state_def) apply (wp get_cap_cte_wp_at | clarsimp)+ apply (clarsimp simp:assertE_def corres_free_fail returnOk_def lift_def) apply (simp add:bindE_def[symmetric] return_returnOk) apply (simp add:bindE_assoc) apply (simp add:bindE_def) apply (rule dcorres_expand_pfx) apply (rule_tac r'= "dc\<oplus>dc" and Q =" \<lambda>r. \<top>"
             and Q'="\<lambda>r s. (r,s)\<in> fst (cap_delete (aa,ba) sfix)" in corres_split_forwards') apply (case_tac "next_revoke_cap slot' sfix") apply clarsimp apply (rule corres_guard_imp[OF delete_cap_corres']) apply clarsimp+ apply (intro conjI, erule cte_wp_at_weakenE,simp) apply (rule descendants_emptyable,simp+) apply (rule descendants_not_idle,simp+) apply (clarsimp|wp)+ apply (fastforce simp:valid_def) apply (clarsimp simp:bindE_def[symmetric] lift_def) apply (case_tac rva) apply (clarsimp simp:boolean_exception_def)+ apply (simp add:bindE_def) apply (rule dcorres_expand_pfx) apply (rule_tac r'= "dc \<oplus> dc" and Q =" \<lambda>r s. case r of Inr a \<Rightarrow> a = False | _  \<Rightarrow> True"
             and Q' = "\<lambda>r s. (case r of Inr rva \<Rightarrow> (r , s) \<in> fst (Exceptions_A.preemption_point s') | _ \<Rightarrow> True)"
             in corres_split_forwards') apply (rule corres_guard_imp[OF corres_trivial[OF preemption_corres]]) apply simp+ apply wp apply (simp add:valid_def throwError_def return_def) apply (simp add:valid_def returnOk_def return_def) apply fastforce apply (clarsimp simp: valid_def) apply clarsimp apply (case_tac rva) apply (clarsimp simp:lift_def boolean_exception_def) apply (rule dcorres_expand_pfx) apply (clarsimp simp:lift_def assertE_def[symmetric] bindE_def[symmetric]) apply (rule corres_guard_imp) apply (rule_tac rv = rv and rva = "cdt sfix" and rvb = "descendants_of slot' (cdt sfix)"
            and rvc = "(aa,ba)" and rvd = rv' and rve = "()" and rvf = "()"
            and st = sfix and sta = sfix and stb = sfix and stc = sfix
            and std = sfix and ste = sfix and stf = s' and stg = s'a in "1") apply ((clarsimp simp: cte_wp_at_def in_monad select_def select_ext_def | rule refl)+) apply (erule use_valid[OF _ preemption_point_inv']) apply simp apply simp apply (simp add: in_monad_cap_delete_invs use_valid [OF _ cap_delete_valid_pdpt_objs] use_valid [OF _ cap_delete_valid_etcbs] select_def) apply (simp add: gets_def valid_def bind_def get_def return_def) apply ((wp get_cap_cte_wp_at|clarsimp)+) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres boolean_exception (\<lambda>_. True) ((=) s' and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot') proof (state)
goal (1 subgoal):
 1. \<And>slot s. (\<And>rv st rva sta rvb stb rvc stc rvd std rve ste rvf stf rvg stg. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap slot) s); (Inr rva, sta) \<in> fst ((without_preemption $ gets cdt) st); (Inr rvb, stb) \<in> fst ((returnOk $ CSpaceAcc_A.descendants_of slot rva) sta); rv \<noteq> cap.NullCap \<and> rvb \<noteq> {}; (Inr rvc, stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot) rvb) stb); (Inr rvd, std) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap rvc) stc); (Inr rve, ste) \<in> fst (assertE (rvd \<noteq> cap.NullCap) std); (Inr rvf, stf) \<in> fst (cap_delete rvc ste); (Inr rvg, stg) \<in> fst (Exceptions_A.preemption_point stf)\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ((=) stg and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot)) \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ((=) s and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot) proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap slot') sfix); (Inr ?rva, ?sta) \<in> fst ((without_preemption $ gets cdt) ?st); (Inr ?rvb, ?stb) \<in> fst ((returnOk $ CSpaceAcc_A.descendants_of slot' ?rva) ?sta); ?rv \<noteq> cap.NullCap \<and> ?rvb \<noteq> {}; (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot') ?rvb) ?stb); (Inr ?rvd, ?std) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap ?rvc) ?stc); (Inr ?rve, ?ste) \<in> fst (assertE (?rvd \<noteq> cap.NullCap) ?std); (Inr ?rvf, ?stf) \<in> fst (cap_delete ?rvc ?ste); (Inr ?rvg, ?stg) \<in> fst (Exceptions_A.preemption_point ?stf)\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ((=) ?stg and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot')

goal (1 subgoal):
 1. \<And>slot s. (\<And>rv st rva sta rvb stb rvc stc rvd std rve ste rvf stf rvg stg. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap slot) s); (Inr rva, sta) \<in> fst ((without_preemption $ gets cdt) st); (Inr rvb, stb) \<in> fst ((returnOk $ CSpaceAcc_A.descendants_of slot rva) sta); rv \<noteq> cap.NullCap \<and> rvb \<noteq> {}; (Inr rvc, stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot) rvb) stb); (Inr rvd, std) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap rvc) stc); (Inr rve, ste) \<in> fst (assertE (rvd \<noteq> cap.NullCap) std); (Inr rvf, stf) \<in> fst (cap_delete rvc ste); (Inr rvg, stg) \<in> fst (Exceptions_A.preemption_point stf)\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ((=) stg and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot)) \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ((=) s and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot) proof (prove)
goal (1 subgoal):
 1. dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot') proof (prove)
goal (1 subgoal):
 1. dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot') proof (prove)
goal (1 subgoal):
 1. dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (doE cap <- without_preemption $ CSpaceAcc_A.get_cap slot';
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ CSpaceAcc_A.descendants_of slot' cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot') descendants;
cap <- without_preemption $ CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
Exceptions_A.preemption_point;
cap_revoke slot'
odE)
odE) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite False ?E (\<lambda>_. True) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) ?a'
 2. dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and valid_etcbs) ?a' (doE cap <- without_preemption $ CSpaceAcc_A.get_cap slot';
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ CSpaceAcc_A.descendants_of slot' cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot') descendants;
cap <- without_preemption $ CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
Exceptions_A.preemption_point;
cap_revoke slot'
odE)
odE) proof (prove)
goal (1 subgoal):
 1. dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and valid_etcbs) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (doE cap <- without_preemption $ CSpaceAcc_A.get_cap slot';
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ CSpaceAcc_A.descendants_of slot' cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot') descendants;
cap <- without_preemption $ CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
Exceptions_A.preemption_point;
cap_revoke slot'
odE)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; ((=) sfix and invs and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (doE cap <- without_preemption $ CSpaceAcc_A.get_cap slot';
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ CSpaceAcc_A.descendants_of slot' cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot') descendants;
cap <- without_preemption $ CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
Exceptions_A.preemption_point;
cap_revoke slot'
odE)
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (do cap <- CSpaceAcc_A.get_cap slot';
cdt <- gets cdt;
whenE (cap \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' cdt \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' cdt);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od)
od) proof (prove)
goal (4 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (do cdt <- gets cdt;
whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' cdt \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' cdt);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od)
od)
 2. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (4 subgoals):
 1. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (do cdt <- gets cdt;
whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' cdt \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' cdt);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od)
od)
 2. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv s s' rva. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) (\<lambda>s. s = sfix \<and> rva = cdt sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' rva \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' rva);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv rva. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) (\<lambda>s. s = sfix \<and> rva = cdt sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' rva \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' rva);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv rva s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; s = transform s'; transform sfix = s; s' = sfix \<and> rva = cdt sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' rva \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' rva);
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do x <- get;
(if KHeap_D.descendants_of (transform_cslot_ptr slot') x = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') x);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))
od) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s') = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) slot' s'
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> valid_mdb s'
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if {} = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (returnOk ())
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> valid_mdb s'
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if {} = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (returnOk ())
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; rv = cap.NullCap; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if {} = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (returnOk True >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then returnOk True else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (return (Inr ()))
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ?Q51 ?Q'51 (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (return (Inr ()))
 2. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; transform sfix = s\<rbrakk> \<Longrightarrow> ?Q51 s
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; sfix = s\<rbrakk> \<Longrightarrow> ?Q'51 s
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> monadic_rewrite False ?E55 ?Q51 (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) ?a'55
 2. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ?Q'51 ?a'55 (return (Inr ()))
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; transform sfix = s\<rbrakk> \<Longrightarrow> ?Q51 s
 4. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; sfix = s\<rbrakk> \<Longrightarrow> ?Q'51 s
 5. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) ?Q'51 (returnOk True) (return (Inr ()))
 2. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; sfix = s\<rbrakk> \<Longrightarrow> ?Q'51 s
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>_. True) (returnOk True) (return (Inr ()))
 2. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = cap.NullCap) slot' sfix; sfix = s\<rbrakk> \<Longrightarrow> True
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (whenE (rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do x <- get;
(if KHeap_D.descendants_of (transform_cslot_ptr slot') x = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') x);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P69 rv s')) s') (cdt s')
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (returnOk ())
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv s'. \<lbrakk>\<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) sfix) (cdt sfix)\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P69 rv s')) s') (cdt s')
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (returnOk ())
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (returnOk ())
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (?P79 rv s') slot' s'
 2. \<And>rv s' c. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'; ?P79 rv s' c\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (returnOk ())
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>x. x = rv) slot' s'; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt s') = {}; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (returnOk ())
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception (?Q87 rv) (?Q'87 rv) (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (returnOk ())
 2. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = s\<rbrakk> \<Longrightarrow> ?Q87 rv s
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; sfix = s\<rbrakk> \<Longrightarrow> ?Q'87 rv s
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> monadic_rewrite False (?E91 rv) (?Q87 rv) (monadic_trancl_preemptible (\<lambda>y. do s <- get;
if KHeap_D.descendants_of (transform_cslot_ptr slot') s = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') s);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od) True) (?a'91 rv)
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (?Q'87 rv) (?a'91 rv) (returnOk ())
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = s\<rbrakk> \<Longrightarrow> ?Q87 rv s
 4. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; sfix = s\<rbrakk> \<Longrightarrow> ?Q'87 rv s
 5. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (?Q'87 rv) (returnOk True) (returnOk ())
 2. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; sfix = s\<rbrakk> \<Longrightarrow> ?Q'87 rv s
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>_. True) (returnOk True) (returnOk ())
 2. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) = {}; sfix = s\<rbrakk> \<Longrightarrow> True
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE (CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (whenE True (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do S <- do s <- get;
return (KHeap_D.descendants_of (transform_cslot_ptr slot') s)
od;
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> return (Inr False)
odE
od
od)) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete child;
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do x <- get;
(if KHeap_D.descendants_of (transform_cslot_ptr slot') x = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') x);
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P107 rv s')) s') (cdt s')
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv s'. \<lbrakk>\<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) sfix) (cdt sfix)\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P107 rv s')) s') (cdt s')
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 3. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' s'
 2. \<And>rv s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = transform s'; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') ((if transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt s') = {} then return (Inr True) else do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>x. x = rv) slot' s'; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt s') \<noteq> {}; sfix = s'\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s')) ((=) s') (do child <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform s'));
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt s'));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform sfix)) ((=) sfix) (do x <- select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix));
xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do child <- select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix));
cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (\<lambda>slot slot'. slot = transform_cslot_ptr slot') ((=) (transform sfix)) ((=) sfix) (select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix))) (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)))
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 4. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (12 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<forall>s'\<in>CSpaceAcc_A.descendants_of slot' (cdt sfix). \<exists>s\<in>KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix). s = transform_cslot_ptr s'
 2. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 6. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 8. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 9. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P136 rv)) sfix) (cdt sfix)
 2. \<And>rv s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' sfix
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<forall>s'\<in>CSpaceAcc_A.descendants_of slot' (cdt sfix). \<exists>s\<in>transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt sfix). s = transform_cslot_ptr s'
 4. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 5. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 6. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 8. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 9. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 10. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s'a. \<lbrakk>\<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) sfix) (cdt sfix)\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at (?P136 rv)) sfix) (cdt sfix)
 2. \<And>rv s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' sfix
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<forall>s'\<in>CSpaceAcc_A.descendants_of slot' (cdt sfix). \<exists>s\<in>transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt sfix). s = transform_cslot_ptr s'
 4. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 5. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 6. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 8. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 9. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 10. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot' sfix
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<forall>s'\<in>CSpaceAcc_A.descendants_of slot' (cdt sfix). \<exists>s\<in>transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt sfix). s = transform_cslot_ptr s'
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 4. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 5. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 7. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 9. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 10. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<forall>s'\<in>CSpaceAcc_A.descendants_of slot' (cdt sfix). \<exists>s\<in>transform_cslot_ptr ` CSpaceAcc_A.descendants_of slot' (cdt sfix). s = transform_cslot_ptr s'
 2. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; transform sfix = s\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 4. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 6. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 8. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 9. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; sfix = s\<rbrakk> \<Longrightarrow> True
 2. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform sfix)\<rbrace> select (KHeap_D.descendants_of (transform_cslot_ptr slot') (transform sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 4. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) \<lbrace>\<lambda>r s. s = sfix \<and> r \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (r, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)\<rbrace>
 2. \<And>rv x child. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; x = transform_cslot_ptr child\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> child \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (child, s) \<in> fst (select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)) (do xa <- KHeap_D.get_cap x;
xa <- assertE (xa \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap x >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) xa >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap child;
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete child >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. s = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s = sfix) (do x <- KHeap_D.get_cap (transform_cslot_ptr (aa, ba));
x <- assertE (x \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap (aa, ba);
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') (do x <- KHeap_D.get_cap (transform_cslot_ptr (aa, ba));
x <- assertE (x \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (do cap <- CSpaceAcc_A.get_cap (aa, ba);
assertE (cap \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
od)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> dcorres (\<lambda>cap cap'. cap = transform_cap cap') ((=) s) ((=) s') (KHeap_D.get_cap (transform_cslot_ptr (aa, ba))) (CSpaceAcc_A.get_cap (aa, ba))
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 4. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); s = transform sfix; (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix; s' = sfix\<rbrakk> \<Longrightarrow> valid_idle sfix \<and> not_idle_thread (fst (next_revoke_cap slot' sfix)) sfix
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 4. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba s s' ab bb. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); s = transform sfix; (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix; s' = sfix; next_revoke_cap slot' sfix = (ab, bb)\<rbrakk> \<Longrightarrow> valid_idle sfix \<and> not_idle_thread (fst (next_revoke_cap slot' sfix)) sfix
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 4. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); next_revoke_cap slot' sfix = (aa, ba)\<rbrakk> \<Longrightarrow> valid_idle sfix \<and> not_idle_thread aa sfix
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 4. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); next_revoke_cap slot' sfix = (aa, ba); not_idle_thread aa sfix\<rbrakk> \<Longrightarrow> valid_idle sfix \<and> not_idle_thread aa sfix
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 4. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (aa, ba)) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>rv a b aa ba s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> CSpaceAcc_A.get_cap (aa, ba) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>x. x = r) (aa, ba) s \<and> s = sfix\<rbrace>
 3. \<And>rv a b aa ba s s' rva rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (aa, ba); s = transform s'; True; s' = sfix \<and> (aa, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<and> (aa, ba) = next_revoke_cap slot' sfix \<and> s' = sfix; rva = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (aa, ba) s \<and> s = sfix) (do x <- assertE (rva \<noteq> cdl_cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (aa, ba)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (aa, ba) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s \<and> s = sfix) (do x <- assertE (rv' \<noteq> cap.NullCap);
lift (\<lambda>y. delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False))) x >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
assertE (cap \<noteq> cdl_cap.NullCap) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))
od) (assertE (rv' \<noteq> cap.NullCap) >>= lift (\<lambda>y. cap_delete (next_revoke_cap slot' sfix) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s \<and> s = sfix) (delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then return (Inr True) else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then return (Inr ()) else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> return (Inr False)))
od
od))) (cap_delete (next_revoke_cap slot' sfix) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s \<and> s = sfix) (doE y <- delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix));
throw \<sqinter> returnOk False
odE >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (doE y <- cap_delete (next_revoke_cap slot' sfix);
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s \<and> s = sfix) (doE x <- delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix));
(throw \<sqinter> returnOk False) >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)
odE) (doE y <- cap_delete (next_revoke_cap slot' sfix);
y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s \<and> s = sfix) (delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) >>= lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)))) (cap_delete (next_revoke_cap slot' sfix) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') (delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) >>= lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)))) (cap_delete (next_revoke_cap slot' sfix) >>= lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix))) (cap_delete (next_revoke_cap slot' sfix))
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba rv' s s' ab bb. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; next_revoke_cap slot' sfix = (ab, bb)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix))) (cap_delete (next_revoke_cap slot' sfix))
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba rv' ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform sfix)) ((=) sfix) (delete_cap (transform_cslot_ptr (ab, ba))) (cap_delete (ab, ba))
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<And>rv a b ba rv' ab s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba); transform sfix = s\<rbrakk> \<Longrightarrow> True
 2. \<And>rv a b ba rv' ab s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba); sfix = s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (ab, ba) and invs and emptyable (ab, ba) and not_idle_thread ab and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) s
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 5. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba rv' ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, ba) sfix \<and> emptyable (ab, ba) sfix \<and> not_idle_thread ab sfix
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<And>rv a b ba rv' ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba)\<rbrakk> \<Longrightarrow> emptyable (ab, ba) sfix
 2. \<And>rv a b ba rv' ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba)\<rbrakk> \<Longrightarrow> not_idle_thread ab sfix
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 5. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba rv' ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (ab, ba); (ab, ba) \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (ab, ba) sfix; next_revoke_cap slot' sfix = (ab, ba)\<rbrakk> \<Longrightarrow> not_idle_thread ab sfix
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> delete_cap (transform_cslot_ptr (next_revoke_cap slot' sfix)) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (aa, ba) sfix)\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv' s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform sfix; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrace>
 2. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> cap_delete (next_revoke_cap slot' sfix) \<lbrace>\<lambda>r s. (r, s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrace>
 2. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; s = transform s'; True; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) s' \<and> s' = sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (aa, ba) sfix)) (lift (\<lambda>x. (throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) rva) (lift (\<lambda>y. Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot')) rv'a)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)) (case rva of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> (throw \<sqinter> returnOk False) >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (case rv'a of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> doE y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv' rva rv'a ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (dc \<oplus> dc) rva rv'a; rva = Inl ab\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)) (case rva of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> (throw \<sqinter> returnOk False) >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (case rv'a of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> doE y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 2. \<And>rv a b aa ba rv' rva rv'a bb. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (dc \<oplus> dc) rva rv'a; rva = Inr bb\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (rv'a, s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)) (case rva of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> (throw \<sqinter> returnOk False) >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (case rv'a of Inl x \<Rightarrow> throwError x | Inr v' \<Rightarrow> doE y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (Inr (), s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)) ((throw \<sqinter> returnOk False) >>=E monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- if cap \<noteq> cdl_cap.NullCap then returnOk () else fail;
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od)) (doE y <- Exceptions_A.preemption_point;
cap_revoke slot'
odE)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>_. True) (\<lambda>s. (Inr (), s) \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)) ((throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s') ((throw \<sqinter> returnOk False) >>= lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od))) (Exceptions_A.preemption_point >>= lift (\<lambda>y. cap_revoke slot'))
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (throw \<sqinter> returnOk False) Exceptions_A.preemption_point
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> throw \<sqinter> returnOk False \<lbrace>\<lambda>r s. case r of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False\<rbrace>
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<And>rv a b aa ba rv' s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); s = sa\<rbrakk> \<Longrightarrow> True
 2. \<And>rv a b aa ba rv' s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); s' = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> throw \<sqinter> returnOk False \<lbrace>\<lambda>r s. case r of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False\<rbrace>
 4. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 5. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> throw \<sqinter> returnOk False \<lbrace>\<lambda>r s. \<forall>a. r = Inr a \<longrightarrow> \<not> a\<rbrace>
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 3. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (11 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>?P245 rv a b aa ba rv' s s'\<rbrace> throw \<lbrace>\<lambda>r s. \<forall>a. r = Inr a \<longrightarrow> \<not> a\<rbrace>
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>?P'245 rv a b aa ba rv' s s'\<rbrace> returnOk False \<lbrace>\<lambda>r s. \<forall>a. r = Inr a \<longrightarrow> \<not> a\<rbrace>
 3. \<And>rv a b aa ba rv' s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); transform s' = sa\<rbrakk> \<Longrightarrow> (?P245 rv a b aa ba rv' s s' and ?P'245 rv a b aa ba rv' s s') sa
 4. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 5. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 7. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 10. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>?P'245 rv a b aa ba rv' s s'\<rbrace> returnOk False \<lbrace>\<lambda>r s. \<forall>a. r = Inr a \<longrightarrow> \<not> a\<rbrace>
 2. \<And>rv a b aa ba rv' s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); transform s' = sa\<rbrakk> \<Longrightarrow> (?P245 rv a b aa ba rv' s s' and ?P'245 rv a b aa ba rv' s s') sa
 3. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 4. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 6. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 9. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv a b aa ba rv' s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); transform s' = sa\<rbrakk> \<Longrightarrow> (?P245 rv a b aa ba rv' s s' and ?P'245 rv a b aa ba rv' s s') sa
 2. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 3. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv' s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> Exceptions_A.preemption_point \<lbrace>\<lambda>r s. case r of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (r, s) \<in> fst (Exceptions_A.preemption_point s')\<rbrace>
 2. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; s = transform s'; True; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. case rva of Inl aa \<Rightarrow> True | Inr a \<Rightarrow> a = False) (\<lambda>s. case rv'a of Inl a \<Rightarrow> True | Inr rva \<Rightarrow> (rv'a, s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' rva rv'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. \<forall>a. rva = Inr a \<longrightarrow> \<not> a) (\<lambda>s. rv'a = Inr () \<longrightarrow> (Inr (), s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv' s' rva rv'a ab. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a; rva = Inl ab\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. \<forall>a. rva = Inr a \<longrightarrow> \<not> a) (\<lambda>s. rv'a = Inr () \<longrightarrow> (Inr (), s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 2. \<And>rv a b aa ba rv' s' rva rv'a bb. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a; rva = Inr bb\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. \<forall>a. rva = Inr a \<longrightarrow> \<not> a) (\<lambda>s. rv'a = Inr () \<longrightarrow> (Inr (), s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' rva rv'a bb. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a; rva = Inr bb\<rbrakk> \<Longrightarrow> dcorres boolean_exception (\<lambda>s. \<forall>a. rva = Inr a \<longrightarrow> \<not> a) (\<lambda>s. rv'a = Inr () \<longrightarrow> (Inr (), s) \<in> fst (Exceptions_A.preemption_point s')) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' rva rv'a bb s s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); (dc \<oplus> dc) rva rv'a; rva = Inr bb; s = transform s'a; \<forall>a. rva = Inr a \<longrightarrow> \<not> a; rv'a = Inr () \<longrightarrow> (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) s) ((=) s'a) (lift (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
(if cap \<noteq> cdl_cap.NullCap then returnOk () else fail) >>= lift (\<lambda>y. delete_cap child >>= lift (\<lambda>y. throw \<sqinter> returnOk False))
od
od)) rva) (lift (\<lambda>y. cap_revoke slot') rv'a)
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> dcorres boolean_exception ((=) (transform s'a)) ((=) s'a) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot')
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> dcorres boolean_exception (?Q296 rv a b aa ba rv' s' bb s'a) (?Q'296 rv a b aa ba rv' s' bb s'a) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot')
 2. \<And>rv a b aa ba rv' s' bb s'a s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s'); transform s'a = s\<rbrakk> \<Longrightarrow> ?Q296 rv a b aa ba rv' s' bb s'a s
 3. \<And>rv a b aa ba rv' s' bb s'a s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s'); s'a = s\<rbrakk> \<Longrightarrow> ?Q'296 rv a b aa ba rv' s' bb s'a s
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (17 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr rv, sfix) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap slot') sfix)
 2. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (cdt sfix), sfix) \<in> fst ((without_preemption $ gets cdt) sfix)
 3. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (CSpaceAcc_A.descendants_of slot' (cdt sfix)), sfix) \<in> fst ((returnOk $ CSpaceAcc_A.descendants_of slot' (cdt sfix)) sfix)
 4. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<and> CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}
 5. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (aa, ba), sfix) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot') (CSpaceAcc_A.descendants_of slot' (cdt sfix))) sfix)
 6. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr rv', sfix) \<in> fst ((without_preemption $ CSpaceAcc_A.get_cap (aa, ba)) sfix)
 7. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (), sfix) \<in> fst (assertE (rv' \<noteq> cap.NullCap) sfix)
 8. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (), s') \<in> fst (cap_delete (aa, ba) sfix)
 9. \<And>rv a b aa ba rv' s' bb s'a. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> (Inr (?rvg300 rv a b aa ba rv' s' bb s'a), s'a) \<in> fst (Exceptions_A.preemption_point s')
 10. \<And>rv a b aa ba rv' s' bb s'a s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; cte_wp_at (\<lambda>x. x = rv) slot' sfix; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; cte_wp_at (\<lambda>x. x = rv') (next_revoke_cap slot' sfix) sfix; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s'a) \<in> fst (Exceptions_A.preemption_point s'); transform s'a = s\<rbrakk> \<Longrightarrow> True
A total of 17 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb; (Inr (), s) \<in> fst (Exceptions_A.preemption_point s')\<rbrakk> \<Longrightarrow> invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> valid_etcbs s
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (9 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> irq_state_independent_A (\<lambda>a. invs a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> valid_etcbs a)
 2. \<And>rv a b aa ba rv' s' bb s f sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> (invs (work_units_completed_update f sa) \<and> (\<forall>x\<in>ran (kheap (work_units_completed_update f sa)). obj_valid_pdpt x) \<and> valid_etcbs (work_units_completed_update f sa)) = (invs sa \<and> (\<forall>x\<in>ran (kheap sa). obj_valid_pdpt x) \<and> valid_etcbs sa)
 3. \<And>rv a b aa ba rv' s' bb s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> invs s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_etcbs s'
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 5. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 8. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (8 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s f sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> (invs (work_units_completed_update f sa) \<and> (\<forall>x\<in>ran (kheap (work_units_completed_update f sa)). obj_valid_pdpt x) \<and> valid_etcbs (work_units_completed_update f sa)) = (invs sa \<and> (\<forall>x\<in>ran (kheap sa). obj_valid_pdpt x) \<and> valid_etcbs sa)
 2. \<And>rv a b aa ba rv' s' bb s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> invs s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_etcbs s'
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 4. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 5. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 7. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (7 subgoals):
 1. \<And>rv a b aa ba rv' s' bb s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; fst (CSpaceAcc_A.get_cap slot' sfix) = {(rv, sfix)}; rv \<noteq> cap.NullCap; CSpaceAcc_A.descendants_of slot' (cdt sfix) \<noteq> {}; (a, b) = transform_cslot_ptr (next_revoke_cap slot' sfix); next_revoke_cap slot' sfix \<in> CSpaceAcc_A.descendants_of slot' (cdt sfix); (aa, ba) = next_revoke_cap slot' sfix; rv' \<noteq> cap.NullCap; fst (CSpaceAcc_A.get_cap (next_revoke_cap slot' sfix) sfix) = {(rv', sfix)}; (Inr (), s') \<in> fst (cap_delete (next_revoke_cap slot' sfix) sfix); \<not> bb\<rbrakk> \<Longrightarrow> invs s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_etcbs s'
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 3. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 6. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (6 subgoals):
 1. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> gets cdt \<lbrace>\<lambda>cdt' s. s = sfix \<and> cdt' = cdt sfix\<rbrace>
 2. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 4. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 5. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal (5 subgoals):
 1. \<And>rv s s' sa. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; s' = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> gets cdt \<lbrace>\<lambda>r. (=) sa\<rbrace>
 2. \<And>rv s s'. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; s = transform s'; transform sfix = s; ((=) sfix and cte_wp_at (\<lambda>x. x = rv) slot') s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (gets cdt)
 3. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix\<rbrakk> \<Longrightarrow> \<lbrace>(=) sfix\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>cap. (=) sfix and cte_wp_at (\<lambda>x. x = cap) slot'\<rbrace>
 4. \<And>s. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; sfix = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap slot' \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<lbrakk>invs sfix; \<forall>x\<in>ran (kheap sfix). obj_valid_pdpt x; valid_etcbs sfix; False\<rbrakk> \<Longrightarrow> no_fail ((=) sfix) (CSpaceAcc_A.get_cap slot') proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres boolean_exception (\<lambda>_. True) ((=) sfix and invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs) (monadic_trancl_preemptible (\<lambda>y. do S <- gets (KHeap_D.descendants_of (transform_cslot_ptr slot'));
if S = {} then returnOk True else do child <- select S;
cap <- KHeap_D.get_cap child;
doE y <- assertE (cap \<noteq> cdl_cap.NullCap);
y <- delete_cap child;
throw \<sqinter> returnOk False
odE
od
od) False) (cap_revoke slot')

goal:
No subgoals!