theory Finalise_C

lemma isFinalCapability_ccorres:
  "ccorres ((=) \<circ> from_bool) ret__unsigned_long_'
   (cte_wp_at' ((=) cte) slot and invs')
   (UNIV \<inter> {s. cte_' s = Ptr slot}) []
   (isFinalCapability cte) (Call isFinalCapability_'proc)" apply (cinit lift: cte_') apply (rule ccorres_Guard_Seq) apply (simp add: Let_def del: Collect_const) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'="mdb_'" in ccorres_abstract) apply ceqv apply (rule_tac P="mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte" in ccorres_gen_asm2) apply csymbr apply (rule_tac r'="(=) \<circ> from_bool" and xf'="prevIsSameObject_'"
               in ccorres_split_nothrow_novcg) apply (rule ccorres_cond2[where R=\<top>]) apply (clarsimp simp: Collect_const_mem nullPointer_def) apply (simp add: mdbPrev_to_H[symmetric]) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (simp add: return_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_symb_exec_l[OF _ getCTE_inv getCTE_wp empty_fail_getCTE]) apply (rule_tac P="cte_wp_at' ((=) cte) slot
                             and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte))
                             and valid_cap' (cteCap rv)
                             and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))"
                    and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def mdbPrev_to_H[symmetric]) apply (simp add: rf_sr_cte_at_validD) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule cmap_relationE1 [OF cmap_relation_cte], assumption+,
                    simp?, simp add: typ_heap_simps)+ apply (drule ccte_relation_ccap_relation)+ apply (rule exI, rule conjI, assumption)+ apply (auto)[1] apply ceqv apply (clarsimp simp del: Collect_const) apply (rule ccorres_cond2[where R=\<top>]) apply (simp add: from_bool_0 Collect_const_mem) apply (rule ccorres_return_C, simp+)[1] apply csymbr apply (rule ccorres_cond2[where R=\<top>]) apply (simp add: nullPointer_def Collect_const_mem mdbNext_to_H[symmetric]) apply (rule ccorres_return_C, simp+)[1] apply (rule ccorres_symb_exec_l[OF _ getCTE_inv getCTE_wp empty_fail_getCTE]) apply (rule_tac P="cte_wp_at' ((=) cte) slot
                           and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode cte))
                           and K (capAligned (cteCap rva) \<and> capAligned (cteCap cte))
                           and valid_cap' (cteCap cte)"
                  and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def from_bool_eq_if from_bool_0
                             mdbNext_to_H[symmetric] rf_sr_cte_at_validD) apply (clarsimp simp: cte_wp_at_ctes_of split: if_split) apply (rule cmap_relationE1 [OF cmap_relation_cte], assumption+,
                  simp?, simp add: typ_heap_simps)+ apply (drule ccte_relation_ccap_relation)+ apply (auto simp: from_bool_def split: bool.splits)[1] apply (wp getCTE_wp') apply (clarsimp simp add: guard_is_UNIV_def Collect_const_mem) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: Collect_const_mem) apply (frule(1) rf_sr_cte_at_validD, simp add: typ_heap_simps) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1 [OF cmap_relation_cte]) apply (simp add: typ_heap_simps) apply (clarsimp simp add: ccte_relation_def map_option_Some_eq2) by (auto,
         auto dest!: ctes_of_valid' [OF _ invs_valid_objs']
              elim!: valid_capAligned)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (cte_wp_at' ((=) cte) slot and invs') (UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot\<rbrace>) [] (isFinalCapability cte) (Call isFinalCapability_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>ctea. ctea = cte_Ptr slot \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 ctea) (?Q'438 ctea) [SKIP] (let mdb = cteMDBNode cte in do prevIsSameObject <- if mdbPrev mdb = nullPointer then return False else do prev <- getCTE (mdbPrev mdb);
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext mdb = nullPointer then return True else do next <- getCTE (mdbNext mdb);
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctea} (\<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctea} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(ctea\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ctea} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(ctea\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)))
 2. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?Q'438 ctea proof (prove)
goal (2 subgoals):
 1. \<And>ctea. ctea = cte_Ptr slot \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 ctea) (?C'444 ctea) [SKIP] (let mdb = cteMDBNode cte in do prevIsSameObject <- if mdbPrev mdb = nullPointer then return False else do prev <- getCTE (mdbPrev mdb);
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext mdb = nullPointer then return True else do next <- getCTE (mdbNext mdb);
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (\<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C'']));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctea} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(ctea\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ctea} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(ctea\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)))
 2. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (2 subgoals):
 1. ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) (?C'444 (cte_Ptr slot)) [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (\<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)))
 2. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (4 subgoals):
 1. ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) ?Q'456 [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI))
 2. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) ?Q'456
 3. \<And>s. ?Q438 (cte_Ptr slot) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (5 subgoals):
 1. \<And>rv' t t'. ceqv \<Gamma> mdb_' rv' t t' (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdb);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdb);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)) (?d'460 rv')
 2. \<And>rv'. ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) (?G'460 rv') [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (?d'460 rv')
 3. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'460 (mdb_' s)}
 4. \<And>s. ?Q438 (cte_Ptr slot) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (4 subgoals):
 1. \<And>rv'. ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) (?G'460 rv') [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI))
 2. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'460 (mdb_' s)}
 3. \<And>s. ?Q438 (cte_Ptr slot) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (4 subgoals):
 1. \<And>rv'. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) (?G'800 rv') [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI))
 2. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'800 (mdb_' s) \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 3. \<And>s. ?Q438 (cte_Ptr slot) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (4 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q438 (cte_Ptr slot)) (?G'807 rv' ret__unsigned) [SKIP] (do prevIsSameObject <- if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od;
if prevIsSameObject then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od
od) (IF ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI;;
IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)
 2. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'807 (mdb_' s) v} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 3. \<And>s. ?Q438 (cte_Ptr slot) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q438 ctea s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?P952 (cte_Ptr slot)) (?G'807 rv' ret__unsigned) [] (if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (IF ret__unsigned = 0 THEN
  \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false
ELSE
  lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))
FI)
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'807 (mdb_' s) v} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. (?P952 (cte_Ptr slot) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P952 ctea and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (10 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (mdbPrev (cteMDBNode cte) = nullPointer) = (s' \<in> \<lbrace>ret__unsigned = 0\<rbrace>)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pt959 (cte_Ptr slot)) (?Rt954 rv' ret__unsigned) [] (return False) (\<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 4. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 5. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 6. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 7. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 8. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt954 (mdb_' s) v) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 9. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 (cte_Ptr slot) s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 ctea s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (10 subgoals):
 1. \<And>rv' s s'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) = 0) = (mdbPrev_CL (mdb_node_lift rv') = 0)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pt959 (cte_Ptr slot)) (?Rt954 rv' ret__unsigned) [] (return False) (\<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 4. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 5. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 6. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 7. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 8. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt954 (mdb_' s) v) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 9. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 (cte_Ptr slot) s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 ctea s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (9 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pt959 (cte_Ptr slot)) (?Rt954 rv' ret__unsigned) [] (return False) (\<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 3. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 6. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 7. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt954 (mdb_' s) v) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 8. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 (cte_Ptr slot) s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt959 ctea s) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (9 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>prevIsSameObject :== SCAST(32 signed \<rightarrow> 32) false {s. \<exists>(rv, \<sigma>')\<in>fst (return False \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> from_bool) rv (prevIsSameObject_' s)}
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 3. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 6. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 7. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 8. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (9 subgoals):
 1. \<And>rv' ret__unsigned \<sigma>. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return False \<sigma>). (\<sigma>', prevIsSameObject_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> rf_sr \<and> from_bool rv = SCAST(32 signed \<rightarrow> 32) false}
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 3. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 6. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 7. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 8. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (?Pf957 (cte_Ptr slot)) (?Rf954 rv' ret__unsigned) [] (do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od) (lvar_nondet_init prev_' prev_'_update;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf954 (mdb_' s) v)}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 (cte_Ptr slot) s) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf957 ctea s) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned rv. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a. ?Q992 (cte_Ptr slot) a rv) (?Q'987 rv' ret__unsigned rv) [] (return $ global.sameObjectAs (cteCap rv) (cteCap cte)) (lvar_nondet_init prev_' prev_'_update;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (sa \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> ?Q992 (cte_Ptr slot) sa rv \<longrightarrow> s' \<in> ?Q'987 (mdb_' s) v rv})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> ?Q992 (cte_Ptr slot) s ctea)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>cteb. cte_wp_at' ((=) cteb) (mdbPrev (cteMDBNode cte)) s \<and> ?Q992 ctea s cteb)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned rv. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init prev_' prev_'_update;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv');;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prevIsSameObject :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>prev\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) {s. \<exists>(rv, \<sigma>')\<in>fst ((return $ global.sameObjectAs (cteCap rv) (cteCap cte)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> from_bool) rv (prevIsSameObject_' s)}
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' ret__unsigned rv \<sigma>. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v t. ret__unsigned_' t = mdbPrev_CL (mdb_node_lift rv') \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev_CL (mdb_node_lift rv')) \<and> s \<Turnstile>\<^sub>c cte_Ptr slot \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (mdbPrev_CL (mdb_node_lift rv'))\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((return $ global.sameObjectAs (cteCap rv) (cteCap cte)) \<sigma>). (\<sigma>', prevIsSameObject_'_update (\<lambda>_. from_bool (global.sameObjectAs capa capb)) (prev_'_update (\<lambda>_. cte_Ptr (mdbPrev_CL (mdb_node_lift rv'))) (s\<lparr>ret__unsigned_' := mdbPrev_CL (mdb_node_lift rv')\<rparr>))) \<in> rf_sr \<and> from_bool rv = from_bool (global.sameObjectAs capa capb)))))}
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; cte_wp_at' ((=) cte) slot \<sigma>; cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) \<sigma>; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode cte)) \<and> x \<Turnstile>\<^sub>c cte_Ptr slot \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbPrev (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs capa capb)))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; cte_wp_at' ((=) cte) slot \<sigma>; cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) \<sigma>; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbPrev (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs capa capb))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ctes_of \<sigma> slot = Some cte; ctes_of \<sigma> (mdbPrev (cteMDBNode cte)) = Some rv; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbPrev (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs capa capb))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t y' y'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte); ctes_of \<sigma> slot = Some cte; ccte_relation cte y'; cslift x (cte_Ptr slot) = Some y'; ctes_of \<sigma> (mdbPrev (cteMDBNode cte)) = Some rv; ccte_relation rv y'a; cslift x (cte_Ptr (mdbPrev (cteMDBNode cte))) = Some y'a\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (cte_C.cap_C y'a) \<and> (\<exists>capb. ccap_relation capb (cte_C.cap_C y') \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs capa capb))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t y' y'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte); ctes_of \<sigma> slot = Some cte; cslift x (cte_Ptr slot) = Some y'; ctes_of \<sigma> (mdbPrev (cteMDBNode cte)) = Some rv; cslift x (cte_Ptr (mdbPrev (cteMDBNode cte))) = Some y'a; ccap_relation (cteCap cte) (cte_C.cap_C y'); ccap_relation (cteCap rv) (cte_C.cap_C y'a)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (cte_C.cap_C y'a) \<and> (\<exists>capb. ccap_relation capb (cte_C.cap_C y') \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs capa capb))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv \<sigma> x t y' y'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; valid_cap' (cteCap rv) \<sigma>; capAligned (cteCap cte); capAligned (cteCap rv); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbPrev (cteMDBNode cte); ctes_of \<sigma> slot = Some cte; cslift x (cte_Ptr slot) = Some y'; ctes_of \<sigma> (mdbPrev (cteMDBNode cte)) = Some rv; cslift x (cte_Ptr (mdbPrev (cteMDBNode cte))) = Some y'a; ccap_relation (cteCap cte) (cte_C.cap_C y'); ccap_relation (cteCap rv) (cte_C.cap_C y'a)\<rbrakk> \<Longrightarrow> capAligned (cteCap rv) \<and> capAligned (cteCap cte) \<and> Ex (valid_cap' (cteCap rv)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs (cteCap rv) (cteCap cte))) \<longrightarrow> global.sameObjectAs (cteCap rv) (cteCap cte) = global.sameObjectAs (cteCap rv) (cteCap cte))
 2. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (7 subgoals):
 1. \<And>rv' ret__unsigned rv'a t t'. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prevIsSameObject_' rv'a t t' (IF \<acute>prevIsSameObject \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI) (?d'946 rv' ret__unsigned rv'a)
 2. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (?d'946 rv' ret__unsigned rv'a)
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 5. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 6. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' ret__unsigned rv rv'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv'); ((=) \<circ> from_bool) rv rv'a\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' ret__unsigned rv) (?Q'946 rv' ret__unsigned rv rv'a) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (IF rv'a \<noteq> 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Q946 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Q'946 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (if rv then return False else if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (IF rv THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI
FI)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>?Q946 rv' ret__unsigned\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (?Q'946 rv' ret__unsigned)
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> rv = (s' \<in> \<lbrace>rv\<rbrace>)
 2. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pt1289 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rt1287 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (return False) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false))
 3. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1288 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1286 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI)
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1289 rv' ret__unsigned a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1288 rv' ret__unsigned a s)\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> ?Rt1287 rv' ret__unsigned a b) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> ?Rf1286 rv' ret__unsigned a b)})
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (7 subgoals):
 1. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pt1289 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rt1287 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (return False) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false))
 2. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1288 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1286 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI)
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1289 rv' ret__unsigned a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1288 rv' ret__unsigned a s)\<rbrace>
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> ?Rt1287 rv' ret__unsigned a b) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> ?Rf1286 rv' ret__unsigned a b)})
 5. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 6. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv. mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1288 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1286 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv)) [SKIP] (if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
IF \<acute>ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1288 rv' ret__unsigned a s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> ?Rf1286 rv' ret__unsigned a b)})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1288 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?G'1305 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (if mdbNext (cteMDBNode cte) = nullPointer then return True else do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (IF ret__unsigned = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
FI)
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1288 rv' ret__unsigned a s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1305 rv' ret__unsigned a b v})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (mdbNext (cteMDBNode cte) = nullPointer) = (s' \<in> \<lbrace>ret__unsigned = 0\<rbrace>)
 2. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pt1431 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rt1428 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (return True) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1429 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1427 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt1431 rv' ret__unsigned a s) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf1429 rv' ret__unsigned a s)) s)\<rbrace>
 5. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> ?Rt1428 rv' ret__unsigned a b v) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> ?Rf1427 rv' ret__unsigned a b v)}})})
 6. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 7. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (7 subgoals):
 1. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pt1431 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rt1428 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (return True) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1429 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1427 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> ?Pt1431 rv' ret__unsigned a s) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf1429 rv' ret__unsigned a s)) s)\<rbrace>
 4. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> ?Rt1428 rv' ret__unsigned a b v) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> ?Rf1427 rv' ret__unsigned a b v)}})})
 5. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 6. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (?Pf1429 rv' (mdbPrev_CL (mdb_node_lift rv')) rv) (?Rf1427 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned) [SKIP] (do next <- getCTE (mdbNext (cteMDBNode cte));
return $ Not $ global.sameObjectAs (cteCap cte) (cteCap next)
od) (lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> ?Pf1429 rv' ret__unsigned a s)) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> ?Rf1427 rv' ret__unsigned a b v)}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv ret__unsigned rva. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> from_bool) ret__unsigned_long_' (\<lambda>s. ?Q1452 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) s rva) (?Q'1450 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) ret__unsigned rva) [SKIP] (return $ Not $ global.sameObjectAs (cteCap cte) (cteCap rva)) (lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> ?Q1449 rv' ret__unsigned a s ctea))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q1452 rv' ret__unsigned a b s rv \<longrightarrow> s' \<in> ?Q'1450 rv' ret__unsigned a b v rv})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea}
flex-flex pairs:
\<lambda>rv' rv. ?Q1452 rv' (mdbPrev_CL (mdb_node_lift rv')) rv (from_bool rv) \<equiv>\<^sup>? \<lambda>rv'. ?Q1449 rv' (mdbPrev_CL (mdb_node_lift rv')) proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv ret__unsigned rva. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rva) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init next_' next_'_update;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv');;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned_long :== CALL sameObjectAs_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>next\<rightarrow>[''cap_C''])))));;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_long_' s = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) {},{s. \<exists>(rv, \<sigma>')\<in>fst ((return $ Not $ global.sameObjectAs (cteCap cte) (cteCap rva)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> from_bool) rv (ret__unsigned_long_' s)}
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv ret__unsigned rva \<sigma>. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbNext_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rva) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v t. ret__unsigned_' t = mdbNext_CL (mdb_node_lift rv') \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr slot \<and> s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift rv')) \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift rv'))\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((return $ Not $ global.sameObjectAs (cteCap cte) (cteCap rva)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := mdbNext_CL (mdb_node_lift rv'), next_' := cte_Ptr (mdbNext_CL (mdb_node_lift rv')), ret__unsigned_long_' := if from_bool (global.sameObjectAs capa capb) = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> from_bool rv = (if from_bool (global.sameObjectAs capa capb) = 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)))))}
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rva \<sigma> x t. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; cte_wp_at' ((=) cte) slot \<sigma>; cte_wp_at' ((=) rva) (mdbNext (cteMDBNode cte)) \<sigma>; capAligned (cteCap rva); capAligned (cteCap cte); valid_cap' (cteCap cte) \<sigma>; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbNext (cteMDBNode cte)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbNext (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameObjectAs capa capb)) \<longrightarrow> from_bool (\<not> global.sameObjectAs (cteCap cte) (cteCap rva)) = (if \<not> global.sameObjectAs capa capb then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rva \<sigma> x t. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ctes_of \<sigma> slot = Some cte; ctes_of \<sigma> (mdbNext (cteMDBNode cte)) = Some rva; capAligned (cteCap rva); capAligned (cteCap cte); valid_cap' (cteCap cte) \<sigma>; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbNext (cteMDBNode cte)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. (\<not> global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbNext (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false) \<longrightarrow> \<not> global.sameObjectAs (cteCap cte) (cteCap rva))) \<and> (global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr (mdbNext (cteMDBNode cte))\<rightarrow>[''cap_C'']))) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true) \<longrightarrow> from_bool (\<not> global.sameObjectAs (cteCap cte) (cteCap rva)) = 0)))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rva \<sigma> x t y' y'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; capAligned (cteCap rva); capAligned (cteCap cte); valid_cap' (cteCap cte) \<sigma>; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbNext (cteMDBNode cte); ctes_of \<sigma> slot = Some cte; ccte_relation cte y'; cslift x (cte_Ptr slot) = Some y'; ctes_of \<sigma> (mdbNext (cteMDBNode cte)) = Some rva; ccte_relation rva y'a; cslift x (cte_Ptr (mdbNext (cteMDBNode cte))) = Some y'a\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (cte_C.cap_C y') \<and> (\<exists>capb. (\<not> global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (cte_C.cap_C y'a) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false) \<longrightarrow> \<not> global.sameObjectAs (cteCap cte) (cteCap rva))) \<and> (global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (cte_C.cap_C y'a) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true) \<longrightarrow> from_bool (\<not> global.sameObjectAs (cteCap cte) (cteCap rva)) = 0)))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (6 subgoals):
 1. \<And>rv' rva \<sigma> x t y' y'a. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; capAligned (cteCap rva); capAligned (cteCap cte); valid_cap' (cteCap cte) \<sigma>; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = mdbNext (cteMDBNode cte); ctes_of \<sigma> slot = Some cte; cslift x (cte_Ptr slot) = Some y'; ctes_of \<sigma> (mdbNext (cteMDBNode cte)) = Some rva; cslift x (cte_Ptr (mdbNext (cteMDBNode cte))) = Some y'a; ccap_relation (cteCap cte) (cte_C.cap_C y'); ccap_relation (cteCap rva) (cte_C.cap_C y'a)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (cte_C.cap_C y') \<and> (\<exists>capb. (\<not> global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (cte_C.cap_C y'a) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false) \<longrightarrow> \<not> global.sameObjectAs (cteCap cte) (cteCap rva))) \<and> (global.sameObjectAs capa capb \<longrightarrow> ccap_relation capb (cte_C.cap_C y'a) \<and> capAligned capa \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true) \<longrightarrow> from_bool (\<not> global.sameObjectAs (cteCap cte) (cteCap rva)) = 0)))
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 3. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 4. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 5. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (5 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R950 (cte_Ptr slot)\<rbrace> if mdbPrev (cteMDBNode cte) = nullPointer then return False else do prev <- getCTE (mdbPrev (cteMDBNode cte));
return $ global.sameObjectAs (cteCap prev) (cteCap cte)
od \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) s)\<rbrace>
 2. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 3. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 4. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 (cte_Ptr slot)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and ?R950 ctea) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (4 subgoals):
 1. \<And>rv' ret__unsigned. \<lbrakk>mdb_node_to_H (mdb_node_lift rv') = cteMDBNode cte; ret__unsigned = mdbPrev_CL (mdb_node_lift rv')\<rbrakk> \<Longrightarrow> guard_is_UNIV ((=) \<circ> from_bool) prevIsSameObject_' (\<lambda>a b. {s. (s \<in> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) False (SCAST(32 signed \<rightarrow> 32) false)\<rbrace>) \<and> (s \<notin> \<lbrace>a\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>((=) \<circ> from_bool) True (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap rv) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s \<longrightarrow> s' \<in> UNIV})}})})
 2. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 3. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (3 subgoals):
 1. \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot)) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdb_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) s \<longrightarrow> s' \<in> UNIV})}} \<inter> \<lbrace>mdb_node_to_H (mdb_node_lift \<^bsup>s\<^esup>mdb) = cteMDBNode cte\<rbrace>}
 2. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'444 (cte_Ptr slot) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<and> s' \<in> ?C'444 ctea \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<Longrightarrow> \<Gamma>\<turnstile> ({s. (\<forall>v. v = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (v = 0 \<longrightarrow> True) \<and> (v \<noteq> 0 \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>mdb_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])), ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) sa \<longrightarrow> True))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdb :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<and> s' \<in> {s. (\<forall>v. v = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (v = 0 \<longrightarrow> True) \<and> (v \<noteq> 0 \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>mdb_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])), ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) sa \<longrightarrow> True))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte} \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<Longrightarrow> {s. (\<forall>v. v = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (v = 0 \<longrightarrow> True) \<and> (v \<noteq> 0 \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>mdb_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])), ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) sa \<longrightarrow> True))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, mdb_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) sa) \<in> rf_sr}
 2. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<and> s' \<in> {s. (\<forall>v. v = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (v = 0 \<longrightarrow> True) \<and> (v \<noteq> 0 \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>mdb_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])), ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) sa \<longrightarrow> True))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte} \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (1 subgoal):
 1. \<And>ctea s s'. \<lbrakk>ctea = cte_Ptr slot; (s, s') \<in> rf_sr; (cte_wp_at' ((=) cte) slot and invs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap ctea) and K (capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) s)) and (\<lambda>a. True \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> (False \<longrightarrow> True) \<and> (\<not> False \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> (global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> True) \<and> (\<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> True) and (\<lambda>s. mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) and K (capAligned (cteCap ctea) \<and> capAligned (cteCap cte)) and valid_cap' (cteCap cte)) s))) a))))) s \<and> s' \<in> {s. (\<forall>v. v = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (v = 0 \<longrightarrow> True) \<and> (v \<noteq> 0 \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>mdb_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])), ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> (cte_wp_at' ((=) cte) slot and cte_wp_at' ((=) rv) (mdbPrev (cteMDBNode cte)) and valid_cap' (cteCap rv) and K (capAligned (cteCap cte) \<and> capAligned (cteCap rv))) sa \<longrightarrow> True))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(ctea\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte} \<inter> {s. s \<Turnstile>\<^sub>c ctea} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; cte_wp_at' ((=) cte) slot s; invs' s\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> valid_cap' (cteCap ctea) s \<and> capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> \<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte \<and> s' \<Turnstile>\<^sub>c cte_Ptr slot proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; cte_wp_at' ((=) cte) slot s; invs' s; s' \<Turnstile>\<^sub>c cte_Ptr slot\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<and> valid_cap' (cteCap ctea) s \<and> capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) s \<longrightarrow> \<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)) s \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; ctes_of s slot = Some cte; invs' s; s' \<Turnstile>\<^sub>c cte_Ptr slot\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<and> valid_cap' (cteCap ctea) s \<and> capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> \<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte proof (prove)
goal (1 subgoal):
 1. \<And>s s' y'. \<lbrakk>ctes_of s slot = Some cte; invs' s; s' \<Turnstile>\<^sub>c cte_Ptr slot; ctes_of s slot = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<and> valid_cap' (cteCap ctea) s \<and> capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> \<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s))) \<and> mdb_node_to_H (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) = cteMDBNode cte proof (prove)
goal (1 subgoal):
 1. \<And>s s' y'. \<lbrakk>invs' s; ctes_of s slot = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<and> valid_cap' (cteCap ctea) s \<and> capAligned (cteCap cte) \<and> capAligned (cteCap ctea))) \<and> (mdbPrev (cteMDBNode cte) = nullPointer \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s)) \<and> (mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> \<not> global.sameObjectAs (cteCap ctea) (cteCap cte) \<longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea) \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<and> capAligned (cteCap ctea) \<and> capAligned (cteCap cte) \<and> valid_cap' (cteCap cte) s))) \<and> mdb_node_to_H (mdb_node_lift (cteMDBNode_C y')) = cteMDBNode cte proof (prove)
goal (1 subgoal):
 1. \<And>s s' y' z. \<lbrakk>invs' s; ctes_of s slot = Some (cte_to_H z); cslift s' (cte_Ptr slot) = Some y'; c_valid_cte y'; cte_lift y' = Some z; cte = cte_to_H z\<rbrakk> \<Longrightarrow> (mdbPrev_CL (cteMDBNode_CL z) \<noteq> nullPointer \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev_CL (cteMDBNode_CL z)) = Some cte) \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev_CL (cteMDBNode_CL z)) = Some cte \<and> valid_cap' (cteCap cte) s \<and> capAligned (cap_to_H (cap_CL z)) \<and> capAligned (cteCap cte))) \<and> (mdbPrev_CL (cteMDBNode_CL z) = nullPointer \<longrightarrow> mdbNext_CL (cteMDBNode_CL z) \<noteq> nullPointer \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext_CL (cteMDBNode_CL z)) = Some cte) \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext_CL (cteMDBNode_CL z)) = Some cte \<and> capAligned (cteCap cte) \<and> capAligned (cap_to_H (cap_CL z)) \<and> valid_cap' (cap_to_H (cap_CL z)) s)) \<and> (mdbPrev_CL (cteMDBNode_CL z) \<noteq> nullPointer \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev_CL (cteMDBNode_CL z)) = Some cte \<longrightarrow> \<not> global.sameObjectAs (cteCap cte) (cap_to_H (cap_CL z)) \<longrightarrow> mdbNext_CL (cteMDBNode_CL z) \<noteq> nullPointer \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext_CL (cteMDBNode_CL z)) = Some cte) \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext_CL (cteMDBNode_CL z)) = Some cte \<and> capAligned (cteCap cte) \<and> capAligned (cap_to_H (cap_CL z)) \<and> valid_cap' (cap_to_H (cap_CL z)) s)))