theory CNodeInv_R

lemma rec_del_corres:
  "\<forall>C \<in> rec_del_concrete args.
   spec_corres s (dc \<oplus> (case args of
                            FinaliseSlotCall _ _ \<Rightarrow> (\<lambda>r r'. fst r = fst r'
                                                           \<and> cap_relation (snd r) (snd r') )
                          | _ \<Rightarrow> dc))
      (einvs and simple_sched_action
            and valid_rec_del_call args
            and cte_at (slot_rdcall args)
            and emptyable (slot_rdcall args)
            and (\<lambda>s. \<not> exposed_rdcall args \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall args) s)
            and (\<lambda>s. case args of ReduceZombieCall cap sl ex \<Rightarrow>
                                     \<forall>t\<in>obj_refs cap. halted_if_tcb t s
                                | _ \<Rightarrow> True))
      (invs' and sch_act_simple and cte_at' (cte_map (slot_rdcall args)) and
       (\<lambda>s. \<not> exposed_rdcall args \<longrightarrow> ex_cte_cap_to' (cte_map (slot_rdcall args)) s)
        and (\<lambda>s. case args of ReduceZombieCall cap sl ex \<Rightarrow>
                     \<exists>cp'. cap_relation cap cp'
                            \<and> ((cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl))
                                 and (\<lambda>s. \<not> capRemovable cp' (cte_map sl)
                                       \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s
                  | _ \<Rightarrow> True))
      (rec_del args) C" proof (induct rule: rec_del.induct,
       simp_all only: rec_del_fails rec_del_concrete_empty
                      red_zombie_will_fail.simps ball_simps(5)) case (1 slot exposed) show ?case apply (clarsimp simp: cteDelete_def liftME_def bindE_assoc
                          split_def) apply (rule spec_corres_guard_imp) apply (rule spec_corres_splitE) apply (rule "1.hyps"[simplified rec_del_concrete_unfold dc_def]) apply (rule drop_spec_corres) apply (simp(no_asm) add: dc_def[symmetric] liftME_def[symmetric]
                                 whenE_liftE) apply (rule corres_when, simp) apply simp apply (rule emptySlot_corres) apply (wp rec_del_invs rec_del_valid_list rec_del_cte_at finaliseSlot_invs hoare_drop_imps
                 preemption_point_inv'
            | simp)+ done next case (2 slot exposed) have prove_imp:
    "\<And>P Q. \<lbrakk> P \<Longrightarrow> Q \<rbrakk> \<Longrightarrow> (P \<longrightarrow> Q) = True" by simp show ?case apply (simp only: rec_del_concrete_unfold finaliseSlot_def) apply (subst rec_del_simps_ext) apply (subst finaliseSlot'_simps_ext) apply (fold reduceZombie_def[unfolded cteDelete_def finaliseSlot_def]) apply (unfold fun_app_def unlessE_whenE K_bind_def split_def) apply (rule spec_corres_guard_imp) apply (rule spec_corres_splitE') apply simp apply (rule get_cap_corres) apply (rule spec_corres_if) apply auto[1] apply (rule drop_spec_corres, rule corres_trivial,
                simp add: returnOk_def) apply (rule spec_corres_splitE') apply simp apply (rule isFinalCapability_corres[where ptr=slot]) apply (rule spec_corres_splitE') apply simp apply (rule finaliseCap_corres[where sl=slot]) apply simp apply simp apply simp apply (rule_tac F="isZombie (fst rv'b) \<or> isNullCap (fst rv'b)"
                      in spec_corres_gen_asm2) apply (rule spec_corres_req[rotated]) apply (rule_tac F="\<lambda>s. invs s \<and> cte_at slot s \<and> s \<turnstile> fst rvb"
                       in spec_corres_add_asm) apply (rule spec_corres_if) apply (erule conjunct1) apply (rule drop_spec_corres, rule corres_trivial,
                     simp add: returnOk_def) apply (rule spec_corres_if) apply (erule conjunct2) apply (rule drop_spec_corres,
                     simp add: liftME_def[symmetric] o_def dc_def[symmetric]) apply (rule updateCap_corres) apply simp apply (simp(no_asm_use) add: cap_cyclic_zombie_def split: cap.split_asm) apply (simp add: is_cap_simps) apply (rule spec_corres_splitE') apply simp apply (rule updateCap_corres, erule conjunct1) apply (case_tac "fst rvb", auto simp: isCap_simps is_cap_simps)[1] apply (rule spec_corres_splitE) apply (rule iffD1 [OF spec_corres_liftME2[where fn="\<lambda>v. (True, NullCap)"]]) apply (rule bspec [OF "2.hyps"(1), unfolded fun_app_def], assumption+) apply (case_tac "fst rvb", simp_all add: isCap_simps is_cap_simps)[1] apply (rename_tac nat) apply (case_tac nat, simp_all)[1] apply clarsimp apply (rule spec_corres_splitE'[OF preemptionPoint_corres]) apply (rule "2.hyps"(2)[unfolded fun_app_def rec_del_concrete_unfold
                                                    finaliseSlot_def],
                          assumption+) apply (wp preemption_point_inv')[1] apply clarsimp+ apply (wp preemptionPoint_invR) apply simp apply clarsimp apply simp apply (wp rec_del_invs rec_del_cte_at reduce_zombie_cap_somewhere
                          rec_del_ReduceZombie_emptyable
                          reduceZombie_invs reduce_zombie_cap_to | simp)+ apply (wp reduceZombie_cap_to reduceZombie_sch_act_simple)+ apply simp apply ((wp replace_cap_invs final_cap_same_objrefs
                        set_cap_cte_wp_at set_cap_cte_cap_wp_to
                        hoare_vcg_const_Ball_lift hoare_weak_lift_imp
                         | simp add: conj_comms
                         | erule finalise_cap_not_reply_master [simplified])+)[1] apply (simp(no_asm_use)) apply (wp make_zombie_invs' updateCap_cap_to'
                        updateCap_cte_wp_at_cases
                        hoare_weak_lift_imp)+ apply (elim conjE, strengthen  subst[where P="cap_relation cap" for cap, mk_strg I _ E]) apply simp apply (wp make_zombie_invs' updateCap_cap_to'
                        updateCap_cte_wp_at_cases
                        hoare_weak_lift_imp)+ apply clarsimp apply (drule_tac cap=a in cap_relation_removables,
                      clarsimp, assumption+) apply (clarsimp simp: conj_comms) apply (wp | simp)+ apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fin s. einvs s \<and> simple_sched_action s
                                      \<and> replaceable s slot (fst fin) rv
                                      \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst fin
                                      \<and> emptyable slot s
                                      \<and> (\<forall>t\<in>obj_refs (fst fin). halted_if_tcb t s)"
                       in hoare_vcg_conj_lift) apply (wp finalise_cap_invs finalise_cap_replaceable
                       finalise_cap_makes_halted
                       hoare_vcg_disj_lift hoare_vcg_ex_lift)[1] apply (rule finalise_cap_cases[where slot=slot]) apply clarsimp apply (frule if_unsafe_then_capD, clarsimp, clarsimp) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule disjE[where P="c = cap.NullCap \<and> P" for c P]) apply clarsimp apply (clarsimp simp: conj_comms dest!: is_cap_simps [THEN iffD1]) apply (frule trans [OF _ appropriate_Zombie, OF sym]) apply (case_tac rv, simp_all add: fst_cte_ptrs_def is_cap_simps
                                             is_final_cap'_def)[1] apply (wp | simp)+ apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> s \<turnstile>' fst fin
                                    \<and> (exposed \<or> ex_cte_cap_to' (cte_map slot) s)
                                    \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s"
                      in hoare_vcg_conj_lift) apply (wp hoare_vcg_disj_lift finaliseCap_invs[where sl="cte_map slot"])[1] apply (rule hoare_vcg_conj_lift) apply (rule finaliseCap_replaceable[where slot="cte_map slot"]) apply (rule finaliseCap_cte_refs) apply clarsimp apply (erule disjE[where P="F \<and> G" for F G]) apply (clarsimp simp: capRemovable_def cte_wp_at_ctes_of) apply (clarsimp dest!: isCapDs simp: cte_wp_at_ctes_of) apply (case_tac "cteCap rv'",
                 auto simp add: isCap_simps is_cap_simps final_matters'_def)[1] apply (wp isFinalCapability_inv hoare_weak_lift_imp
                 | simp add: is_final_cap_def conj_comms cte_wp_at_eq_simp)+ apply (rule isFinal[where x="cte_map slot"]) apply (wp get_cap_wp| simp add: conj_comms)+ apply (wp getCTE_wp') apply clarsimp apply (frule cte_wp_at_valid_objs_valid_cap[where P="(=) cap" for cap]) apply fastforce apply (fastforce simp: cte_wp_at_caps_of_state) apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule ctes_of_valid', clarsimp) apply ((clarsimp | rule conjI)+)[1] done next case (3 ptr bits n slot) show ?case apply simp apply (rule drop_spec_corres) apply (simp add: reduceZombie_def case_Zombie_assert_fold) apply (rule stronger_corres_guard_imp[rotated]) apply assumption apply (rule conjI) apply clarsimp apply (drule cte_wp_valid_cap, clarsimp) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (drule cte_at_replicate_zbits) apply (drule cte_at_get_cap_wp, clarsimp) apply (rule cte_wp_at_weakenE') apply (erule(1) pspace_relation_cte_wp_at[OF state_relation_pspace_relation]) apply clarsimp+ apply (rule TrueI) apply assumption apply (rule_tac F="(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot" in corres_req) apply (clarsimp simp: capCyclicZombie_def cte_map_replicate) apply (rule_tac F="ptr \<noteq> cte_map slot" in corres_req) apply (elim conjE exE) apply (frule cte_wp_valid_cap, clarsimp) apply (drule cte_map_inj) apply (erule cte_at_replicate_zbits) apply (erule cte_wp_at_weakenE, simp) apply clarsimp+ apply (simp add: cte_map_replicate) apply (simp add: liftM_def liftME_def[symmetric]) apply (simp add: liftE_bindE) apply (rule corres_symb_exec_r [OF _ getCTE_sp]) apply (rule_tac F="isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr"
                   in corres_req) apply (clarsimp simp: state_relation_def dest!: isCapDs) apply (drule pspace_relation_cte_wp_atI') apply (subst(asm) eq_commute, assumption) apply clarsimp apply clarsimp apply (case_tac c, simp_all)[1] apply (clarsimp simp: cte_wp_at_def) apply (drule(1) zombies_finalD2, clarsimp+) apply (fold dc_def) apply (rule corres_guard_imp, rule capSwapForDelete_corres) apply (simp add: cte_map_replicate) apply simp apply clarsimp apply (rule conjI, clarsimp)+ apply (rule conjI, rule cte_at_replicate_zbits, erule cte_wp_valid_cap) apply clarsimp apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule tcb_valid_nonspecial_cap, fastforce) apply (clarsimp simp: ran_tcb_cap_cases is_cap_simps is_nondevice_page_cap_simps
                       split: Structures_A.thread_state.split) apply (simp add: ran_tcb_cap_cases is_cap_simps is_nondevice_page_cap_simps) apply fastforce apply wp apply (rule no_fail_pre, wp) apply (clarsimp simp: cte_map_replicate) done next note if_cong [cong] option.case_cong [cong] case (4 ptr bits n slot) let ?target = "(ptr, nat_to_cref (zombie_cte_bits bits) n)" note hyps = "4.hyps"[simplified rec_del_concrete_unfold spec_corres_liftME2] show ?case apply (simp only: rec_del_concrete_unfold cap_relation.simps) apply (simp add: reduceZombie_def Let_def
                     liftE_bindE
                del: inf_apply) apply (subst rec_del_simps_ext) apply (rule_tac F="ptr + 2 ^ cte_level_bits * of_nat n
                         = cte_map ?target"
              in spec_corres_req) apply clarsimp apply (drule cte_wp_valid_cap, clarsimp) apply (subst cte_map_nat_to_cref) apply (drule valid_Zombie_n_less_cte_bits, simp) apply (clarsimp simp: valid_cap_def cap_aligned_def word_bits_def
                     split: option.split_asm) apply (simp add: cte_level_bits_def) apply (simp add: spec_corres_liftME2 pred_conj_assoc) apply (rule spec_corres_locate_Zombie) apply (auto dest: cte_wp_valid_cap)[1] apply (rule_tac F="n < 2 ^ (word_bits - cte_level_bits)" in spec_corres_req) apply clarsimp apply (drule cte_wp_valid_cap, clarsimp) apply (frule valid_Zombie_n_less_cte_bits) apply (drule Suc_le_lessD) apply (erule order_less_le_trans) apply (rule power_increasing) apply (clarsimp simp: valid_cap_def cap_aligned_def
                     split: option.split_asm) apply (simp add: cte_level_bits_def word_bits_def) apply simp apply simp apply (rule spec_corres_gen_asm2) apply (rule spec_corres_guard_imp) apply (rule spec_corres_splitE) apply (rule hyps) apply (simp add: in_monad) apply (rule drop_spec_corres) apply (simp add: liftE_bindE del: rec_del.simps) apply (rule corres_split[OF get_cap_corres]) apply (rule_tac F="cteCap ourCTE = Zombie ptr (zbits_map bits) (Suc n)
                               \<or> cteCap ourCTE = NullCap
                               \<or> (\<exists>zb n cp. cteCap ourCTE = Zombie (cte_map slot) zb n
                                      \<and> cp = Zombie ptr (zbits_map bits) (Suc n)
                                      \<and> capZombiePtr cp \<noteq> cte_map slot)"
                      in corres_gen_asm2) apply (rule_tac P="invs and cte_wp_at (\<lambda>c. c = new_cap) slot
                                and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c
                                                    \<and> ?target \<in> fst_cte_ptrs c) ?target"
                     and  P'="invs' and sch_act_simple
                                    and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot)
                                    and cte_at' (cte_map ?target)"
                     in corres_inst) apply (erule disjE) apply (case_tac new_cap, simp_all split del: if_split)[1] apply (simp add: liftME_def[symmetric]) apply (rule stronger_corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule_tac F="cteCap endCTE = capability.NullCap"
                            in corres_gen_asm2, simp) apply (rule updateCap_corres) apply simp apply (simp add: is_cap_simps) apply (rule_tac R="\<lambda>rv. cte_at' (cte_map ?target)" in hoare_post_add) apply (wp, (wp getCTE_wp)+) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule no_fail_pre, wp, simp) apply clarsimp apply (frule zombies_finalD, clarsimp) apply (clarsimp simp: is_cap_simps) apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps) apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule cte_wp_valid_cap[unfolded cte_wp_at_eq_simp], clarsimp) apply (drule cte_wp_at_norm[where p="?target"], clarsimp) apply (erule disjE) apply (drule(1) pspace_relation_cte_wp_at
                                [OF state_relation_pspace_relation],
                   clarsimp+) apply (clarsimp simp: cte_wp_at_ctes_of) apply (clarsimp simp: is_cap_simps fst_cte_ptrs_def
                                 cte_wp_at_ctes_of) apply (frule cte_at_cref_len [rotated, OF cte_at_replicate_zbits]) apply (fastforce simp add: cte_wp_at_caps_of_state) apply clarsimp apply (drule(1) nat_to_cref_replicate_Zombie) apply simp apply (clarsimp simp: capRemovable_def cte_wp_at_def) apply (drule(1) zombies_finalD2, clarsimp+) apply (simp add: is_cap_simps) apply (erule disjE) apply (case_tac new_cap, simp_all split del: if_split)[1] apply (simp add: assertE_def returnOk_def) apply (elim exE conjE) apply (case_tac new_cap, simp_all)[1] apply (clarsimp simp add: is_zombie_def) apply (simp add: assertE_def liftME_def[symmetric]
                        split del: if_split) apply (rule corres_req[rotated], subst if_P, assumption) apply (simp add: returnOk_def) apply (clarsimp simp: zombie_alignment_oddity cte_map_replicate) apply (wp get_cap_cte_wp_at getCTE_wp' rec_del_cte_at
                   rec_del_invs rec_del_delete_cases)+ apply (rule hoare_post_imp_R) apply (rule_tac P="\<lambda>cp. cp = Zombie ptr (zbits_map bits) (Suc n)"
                    in cteDelete_cte_wp_at_invs[where p="cte_map slot"]) apply clarsimp apply (clarsimp simp: cte_wp_at_ctes_of | rule conjI)+ apply (clarsimp simp: capRemovable_def shiftl_t2n[symmetric]) apply (drule arg_cong[where f="\<lambda>x. x >> cte_level_bits"],
             subst(asm) shiftl_shiftr_id) apply (clarsimp simp: cte_level_bits_def word_bits_def) apply (rule order_less_le_trans) apply (erule of_nat_mono_maybe [rotated]) apply (rule power_strict_increasing) apply (simp add: word_bits_def cte_level_bits_def) apply simp apply (simp add: word_bits_def) apply simp apply (erule(1) notE [rotated, OF _ of_nat_neq_0]) apply (erule order_less_le_trans) apply (rule power_increasing) apply (simp add: word_bits_def cte_level_bits_def) apply simp apply clarsimp apply (frule cte_wp_valid_cap, clarsimp) apply (rule conjI, erule cte_at_nat_to_cref_zbits) apply simp apply (simp add: halted_emptyable) apply (erule(1) zombie_is_cap_toE) apply simp apply simp apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule ctes_of_valid', clarsimp+) apply (frule valid_Zombie_cte_at'[where n=n]) apply (clarsimp simp: valid_cap'_def) apply (intro conjI) apply (fastforce simp: cte_wp_at_ctes_of cte_level_bits_def objBits_defs
                            mult.commute mult.left_commute) apply (clarsimp simp: ex_cte_cap_to'_def cte_wp_at_ctes_of) apply (rule_tac x="cte_map slot" in exI) apply (clarsimp simp: image_def) apply (rule_tac x="of_nat n" in bexI) apply (fastforce simp: cte_level_bits_def objBits_defs mult.commute mult.left_commute) apply simp apply (subst field_simps, rule plus_one_helper2) apply simp apply (frule of_nat_mono_maybe[rotated, where 'a=32]) apply (rule power_strict_increasing) apply (simp add: word_bits_def cte_level_bits_def) apply simp apply clarsimp apply (drule_tac f="\<lambda>x. x - 1" and y=0 in arg_cong) apply (clarsimp simp: word_bits_def cte_level_bits_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>C\<in>rec_del_concrete args. spec_corres s (dc \<oplus> (case args of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call args and cte_wp_at (\<lambda>_. True) (slot_rdcall args) and emptyable (slot_rdcall args) and (\<lambda>s. \<not> exposed_rdcall args \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall args) s) and (\<lambda>s. case args of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall args)) and (\<lambda>s. \<not> exposed_rdcall args \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall args)) s) and (\<lambda>s. case args of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del args) C proof (state)
goal (4 subgoals):
 1. \<And>slot exposed s. \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall slot exposed). spec_corres s (dc \<oplus> (case CTEDeleteCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall slot exposed)) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall slot exposed)) C
 2. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 3. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 4. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:
\<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C

goal (4 subgoals):
 1. \<And>slot exposed s. \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall slot exposed). spec_corres s (dc \<oplus> (case CTEDeleteCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall slot exposed)) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall slot exposed)) C
 2. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 3. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 4. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. \<forall>C\<in>rec_del_concrete (CTEDeleteCall slot exposed). spec_corres s_ (dc \<oplus> (case CTEDeleteCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall slot exposed)) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall slot exposed)) C proof (prove)
goal (1 subgoal):
 1. spec_corres s_ ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (\<lambda>a. invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> cte_wp_at (\<lambda>_. True) slot a \<and> emptyable slot a \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a)) (\<lambda>a. invs' a \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) a)) (doE p <- rec_del (FinaliseSlotCall slot exposed);
y <- liftE (when (exposed \<or> fst p) (empty_slot slot (snd p)));
returnOk undefined
odE) (doE x <- finaliseSlot (cte_map slot) exposed;
x <- whenE (exposed \<or> fst x) (liftE (emptySlot (cte_map slot) (snd x)));
returnOk (True, capability.NullCap)
odE) proof (prove)
goal (3 subgoals):
 1. spec_corres s_ ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) ?Q9 ?Q'9 (doE p <- rec_del (FinaliseSlotCall slot exposed);
y <- liftE (when (exposed \<or> fst p) (empty_slot slot (snd p)));
returnOk undefined
odE) (doE x <- finaliseSlot (cte_map slot) exposed;
x <- whenE (exposed \<or> fst x) (liftE (emptySlot (cte_map slot) (snd x)));
returnOk (True, capability.NullCap)
odE)
 2. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> ?Q9 s_
 3. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> ?Q'9 s' proof (prove)
goal (6 subgoals):
 1. spec_corres s_ ((\<lambda>a b. True) \<oplus> ?r'13) ?P13 ?P'13 (rec_del (FinaliseSlotCall slot exposed)) (finaliseSlot (cte_map slot) exposed)
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s_); ?r'13 rv rv'\<rbrakk> \<Longrightarrow> spec_corres s' ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R13 rv) (?R'13 rv') (doE y <- liftE (when (exposed \<or> fst rv) (empty_slot slot (snd rv)));
returnOk undefined
odE) (doE x <- whenE (exposed \<or> fst rv') (liftE (emptySlot (cte_map slot) (snd rv')));
returnOk (True, capability.NullCap)
odE)
 3. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>?R13\<rbrace>, -
 4. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>?R'13\<rbrace>, -
 5. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (?P13 and ?Q13) s_
 6. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (?P'13 and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s_); (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> \<lambda>a b. True) rv rv'\<rbrakk> \<Longrightarrow> spec_corres s' ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R13 rv) (?R'13 rv') (doE y <- liftE (when (exposed \<or> fst rv) (empty_slot slot (snd rv)));
returnOk undefined
odE) (doE x <- whenE (exposed \<or> fst rv') (liftE (emptySlot (cte_map slot) (snd rv')));
returnOk (True, capability.NullCap)
odE)
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>?R13\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>?R'13\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s_); (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> \<lambda>a b. True) rv rv'\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R13 rv) (?R'13 rv') (doE y <- liftE (when (exposed \<or> fst rv) (empty_slot slot (snd rv)));
returnOk undefined
odE) (doE x <- whenE (exposed \<or> fst rv') (liftE (emptySlot (cte_map slot) (snd rv')));
returnOk (True, capability.NullCap)
odE)
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>?R13\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>?R'13\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s_); (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> \<lambda>a b. True) rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R13 rv) (?R'13 rv') (when (exposed \<or> fst rv) (empty_slot slot (snd rv))) (when (exposed \<or> fst rv') (emptySlot (cte_map slot) (snd rv')))
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>?R13\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>?R'13\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (rec_del (FinaliseSlotCall slot exposed) s_); (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> \<lambda>a b. True) rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P22 rv) (?P'24 rv') (empty_slot slot (snd rv)) (emptySlot (cte_map slot) (snd rv'))
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv x. exposed \<or> fst rv \<longrightarrow> ?P22 rv x\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>\<lambda>rv' x. exposed \<or> fst rv' \<longrightarrow> ?P'24 rv' x\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst ((doE cap <- liftE (get_cap slot);
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- liftE (is_final_cap cap);
(remainder, cleanup_info) <- liftE (finalise_cap cap is_final);
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE y <- liftE (set_cap remainder slot);
returnOk (False, cap.NullCap)
odE else doE y <- liftE (set_cap remainder slot);
y <- rec_del (ReduceZombieCall remainder slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) s_); fst rv = fst rv' \<and> cap_relation (snd rv) (snd rv')\<rbrakk> \<Longrightarrow> corres dc (?P22 rv) (?P'24 rv') (empty_slot slot (snd rv)) (emptySlot (cte_map slot) (snd rv'))
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv x. exposed \<or> fst rv \<longrightarrow> ?P22 rv x\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>\<lambda>rv' x. exposed \<or> fst rv' \<longrightarrow> ?P'24 rv' x\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst ((doE cap <- liftE (get_cap slot);
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- liftE (is_final_cap cap);
(remainder, cleanup_info) <- liftE (finalise_cap cap is_final);
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE y <- liftE (set_cap remainder slot);
returnOk (False, cap.NullCap)
odE else doE y <- liftE (set_cap remainder slot);
y <- rec_del (ReduceZombieCall remainder slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) s_); fst rv = fst rv' \<and> cap_relation (snd rv) (snd rv')\<rbrakk> \<Longrightarrow> cap_relation (snd rv) (snd rv')
 2. \<lbrace>?Q13\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv x. exposed \<or> fst rv \<longrightarrow> (einvs and cte_wp_at (\<lambda>_. True) slot) x\<rbrace>, -
 3. \<lbrace>?Q'13\<rbrace> finaliseSlot (cte_map slot) exposed \<lbrace>\<lambda>rv' x. exposed \<or> fst rv' \<longrightarrow> (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) x\<rbrace>, -
 4. invs s_ \<and> valid_list s_ \<and> valid_sched s_ \<and> simple_sched_action s_ \<and> cte_wp_at (\<lambda>_. True) slot s_ \<and> emptyable slot s_ \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_) \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q13) s_
 5. \<And>s'. invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'13) s' proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>C\<in>rec_del_concrete (CTEDeleteCall slot exposed). spec_corres s_ (dc \<oplus> (case CTEDeleteCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall slot exposed)) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall slot exposed))) s) and (\<lambda>s. case CTEDeleteCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall slot exposed)) C

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 2. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 2. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s_); ?rv \<noteq> cap.NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst ?rvb) slot exposed). spec_corres ?stc (dc \<oplus> (case ReduceZombieCall (fst ?rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst ?rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst ?rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst ?rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst ?rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst ?rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst ?rvb) slot exposed)) C
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s_); ?rv \<noteq> cap.NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb); (Inr ?rvd, ?std) \<in> fst (rec_del (ReduceZombieCall (fst ?rvb) slot exposed) ?stc); (Inr ?rve, ?ste) \<in> fst (preemption_point ?std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ?ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 2. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. \<And>P Q. (P \<Longrightarrow> Q) \<Longrightarrow> (P \<longrightarrow> Q) = True proof (state)
this:
(?P \<Longrightarrow> ?Q) \<Longrightarrow> (?P \<longrightarrow> ?Q) = True

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed). spec_corres stc (dc \<oplus> (case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) C; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> cap.NullCap; (Inr rva, sta) \<in> fst ((without_preemption $ is_final_cap rv) st); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) sta); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres ste (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C\<rbrakk> \<Longrightarrow> \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C
 2. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 3. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. \<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) (finaliseSlot' (cte_map slot) exposed) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (doE cap <- without_preemption $ get_cap slot;
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, cap.NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) (finaliseSlot' (cte_map slot) exposed) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (doE cap <- without_preemption $ get_cap slot;
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, cap.NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) (doE cte <- withoutPreemption $ getCTE (cte_map slot);
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder (cte_map slot) then returnOk (True, info) else if \<not> exposed \<and> capCyclicZombie remainder (cte_map slot) then doE withoutPreemption $ updateCap (cte_map slot) remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap (cte_map slot) remainder;
let (v33, v34) = (remainder, exposed) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> cte_map slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr (cte_map slot)
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE (cte_map slot);
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap (cte_map slot)
od else haskell_assertE (ptr2 = cte_map slot \<and> ptr \<noteq> cte_map slot) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE
odE) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (doE cap <- without_preemption $ get_cap slot;
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, cap.NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) (doE cte <- withoutPreemption $ getCTE (cte_map slot);
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder (cte_map slot) then returnOk (True, info) else if \<not> exposed \<and> capCyclicZombie remainder (cte_map slot) then doE withoutPreemption $ updateCap (cte_map slot) remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap (cte_map slot) remainder;
reduceZombie remainder (cte_map slot) exposed;
preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE
odE) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (doE cap <- without_preemption (get_cap slot);
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption (is_final_cap cap);
p <- without_preemption (finalise_cap cap is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) (doE cte <- withoutPreemption (getCTE (cte_map slot));
if isNullCap (cteCap cte) then returnOk (True, capability.NullCap) else doE final <- withoutPreemption (isFinalCapability cte);
p <- withoutPreemption (global.finaliseCap (cteCap cte) final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE
odE) proof (prove)
goal (3 subgoals):
 1. spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) ?Q ?Q' (doE cap <- without_preemption (get_cap slot);
if cap = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption (is_final_cap cap);
p <- without_preemption (finalise_cap cap is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) (doE cte <- withoutPreemption (getCTE (cte_map slot));
if isNullCap (cteCap cte) then returnOk (True, capability.NullCap) else doE final <- withoutPreemption (isFinalCapability cte);
p <- withoutPreemption (global.finaliseCap (cteCap cte) final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE
odE)
 2. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> ?Q s_
 3. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> ?Q' s' proof (prove)
goal (6 subgoals):
 1. corres (dc \<oplus> ?r'4) ?P4 ?P'4 (without_preemption (get_cap slot)) (withoutPreemption (getCTE (cte_map slot)))
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); ?r'4 rv rv'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R4 rv) (?R'4 rv') (if rv = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (if isNullCap (cteCap rv') then returnOk (True, capability.NullCap) else doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 3. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>?R4\<rbrace>, -
 4. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>?R'4\<rbrace>, -
 5. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (?P4 and ?Q4) s_
 6. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (?P'4 and ?Q'4) s' proof (prove)
goal (6 subgoals):
 1. corres ?r'4 ?P4 ?P'4 (get_cap slot) (getCTE (cte_map slot))
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); ?r'4 rv rv'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R4 rv) (?R'4 rv') (if rv = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (if isNullCap (cteCap rv') then returnOk (True, capability.NullCap) else doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 3. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>?R4\<rbrace>, -
 4. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>?R'4\<rbrace>, -
 5. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (?P4 and ?Q4) s_
 6. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (?P'4 and ?Q'4) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R4 rv) (?R'4 rv') (if rv = cap.NullCap then returnOk (True, cap.NullCap) else doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (if isNullCap (cteCap rv') then returnOk (True, capability.NullCap) else doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 2. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>?R4\<rbrace>, -
 3. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>?R'4\<rbrace>, -
 4. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 5. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> (rv = cap.NullCap) = isNullCap (cteCap rv')
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv = cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P12 rv) (?P'16 rv') (returnOk (True, cap.NullCap)) (returnOk (True, capability.NullCap))
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q14 rv) (?Q'18 rv') (doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> ?P12 rv x) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> ?Q14 rv x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> ?P'16 rv' x) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> ?Q'18 rv' x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv = cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P12 rv) (?P'16 rv') (returnOk (True, cap.NullCap)) (returnOk (True, capability.NullCap))
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q14 rv) (?Q'18 rv') (doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 3. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> ?P12 rv x) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> ?Q14 rv x)\<rbrace>, -
 4. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> ?P'16 rv' x) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> ?Q'18 rv' x)\<rbrace>, -
 5. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 6. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q14 rv) (?Q'18 rv') (doE is_final <- without_preemption (is_final_cap rv);
p <- without_preemption (finalise_cap rv is_final);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE final <- withoutPreemption (isFinalCapability rv');
p <- withoutPreemption (global.finaliseCap (cteCap rv') final False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 2. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> ?Q14 rv x)\<rbrace>, -
 3. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> ?Q'18 rv' x)\<rbrace>, -
 4. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 5. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'32 rv rv' s') (?P33 rv) (?P'35 rv') (without_preemption (is_final_cap rv)) (withoutPreemption (isFinalCapability rv'))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); ?r'32 rv rv' s' rva rv'a\<rbrakk> \<Longrightarrow> spec_corres s'a (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R32 rv rv' s' rva) (?R'32 rv rv' s' rv'a) (doE p <- without_preemption (finalise_cap rv rva);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE p <- withoutPreemption (global.finaliseCap (cteCap rv') rv'a False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>?R32 rv rv' s'\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>?R'32 rv rv' s'\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (?P33 rv and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (?P'35 rv' and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> corres (?r'32 rv rv' s') (?P33 rv) (?P'35 rv') (is_final_cap rv) (isFinalCapability rv')
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); ?r'32 rv rv' s' rva rv'a\<rbrakk> \<Longrightarrow> spec_corres s'a (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R32 rv rv' s' rva) (?R'32 rv rv' s' rv'a) (doE p <- without_preemption (finalise_cap rv rva);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE p <- withoutPreemption (global.finaliseCap (cteCap rv') rv'a False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>?R32 rv rv' s'\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>?R'32 rv rv' s'\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (?P33 rv and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (?P'35 rv' and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> spec_corres s'a (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R32 rv rv' s' rva) (?R'32 rv rv' s' rv'a) (doE p <- without_preemption (finalise_cap rv rva);
if cap_removeable (fst p) slot then returnOk (True, snd p) else if cap_cyclic_zombie (fst p) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst p) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst p) slot);
y <- rec_del (ReduceZombieCall (fst p) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE) (doE p <- withoutPreemption (global.finaliseCap (cteCap rv') rv'a False);
if capRemovable (fst p) (cte_map slot) then returnOk (True, snd p) else if \<not> exposed \<and> capCyclicZombie (fst p) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst p));
y <- reduceZombie (fst p) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE
odE)
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>?R32 rv rv' s'\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>?R'32 rv rv' s'\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'44 rv rv' s' rva rv'a s'a) (?P45 rv rv' s' rva) (?P'47 rv rv' s' rv'a) (without_preemption (finalise_cap rv rva)) (withoutPreemption (global.finaliseCap (cteCap rv') rv'a False))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); ?r'44 rv rv' s' rva rv'a s'a rvb rv'b\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. ?P45 rv rv' s' rva and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. ?P'47 rv rv' s' rv'a and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> corres (?r'44 rv rv' s' rva rv'a s'a) (?P45 rv rv' s' rva) (?P'47 rv rv' s' rv'a) (finalise_cap rv rva) (global.finaliseCap (cteCap rv') rv'a False)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); ?r'44 rv rv' s' rva rv'a s'a rvb rv'b\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. ?P45 rv rv' s' rva and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. ?P'47 rv rv' s' rv'a and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; final_matters' (cteCap rv')\<rbrakk> \<Longrightarrow> rva = rv'a
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> cap_relation rv (cteCap rv')
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> False \<longrightarrow> can_fast_finalise rv
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> cap_relation rv (cteCap rv')
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> False \<longrightarrow> can_fast_finalise rv
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> False \<longrightarrow> can_fast_finalise rv
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?R'44 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>?R'44 rv rv' s' rva rv'a s'a\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?P'67 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. ?P'67 rv rv' s' rva rv'a s'a rv'b and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R44 rv rv' s' rva rv'a s'a rvb) (?P'67 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?R44 rv rv' s' rva rv'a s'a rvb s'b; ?P'67 rv rv' s' rva rv'a s'a rv'b s'c; (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>?R44 rv rv' s' rva rv'a s'a\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. ?P'67 rv rv' s' rva rv'a s'a rv'b and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P72 rv rv' s' rva rv'a s'a rvb) (?P'67 rv rv' s' rva rv'a s'a rv'b) (if cap_removeable (fst rvb) slot then returnOk (True, snd rvb) else if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if capRemovable (fst rv'b) (cte_map slot) then returnOk (True, snd rv'b) else if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); (?P72 rv rv' s' rva rv'a s'a rvb and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; ?P'67 rv rv' s' rva rv'a s'a rv'b s'c; (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. ?P72 rv rv' s' rva rv'a s'a rvb and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. ?P'67 rv rv' s' rva rv'a s'a rv'b and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b; cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P75 rv rv' s' rva rv'a s'a rvb) (?P'79 rv rv' s' rva rv'a s'a rv'b) (returnOk (True, snd rvb)) (returnOk (True, snd rv'b))
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q77 rv rv' s' rva rv'a s'a rvb) (?Q'81 rv rv' s' rva rv'a s'a rv'b) (if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> ?P75 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?P'79 rv rv' s' rva rv'a s'a rv'b s'c) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b s'c); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> ?F68 rv rv' s' rva rv'a s'a rvb rv'b s'b
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> ?P75 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?P'79 rv rv' s' rva rv'a s'a rv'b x) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b x)) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P75 rv rv' s' rva rv'a s'a rvb) (?P'79 rv rv' s' rva rv'a s'a rv'b) (returnOk (True, snd rvb)) (returnOk (True, snd rv'b))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q77 rv rv' s' rva rv'a s'a rvb) (?Q'81 rv rv' s' rva rv'a s'a rv'b) (if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> ?P75 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?P'79 rv rv' s' rva rv'a s'a rv'b s'c) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b s'c); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> ?P75 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?P'79 rv rv' s' rva rv'a s'a rv'b x) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b x)) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q77 rv rv' s' rva rv'a s'a rvb) (?Q'81 rv rv' s' rva rv'a s'a rv'b) (if cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed then doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE else doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (if \<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) then doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE else doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b s'c); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> ?Q77 rv rv' s' rva rv'a s'a rvb x)) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> ?Q'81 rv rv' s' rva rv'a s'a rv'b x)) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P92 rv rv' s' rva rv'a s'a rvb) (?P'96 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b; \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> ?Q85 rv rv' s' rva rv'a s'a rvb rv'b s'b
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?P92 rv rv' s' rva rv'a s'a rvb) (?P'96 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
returnOk (False, cap.NullCap)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
returnOk (False, capability.NullCap)
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> capCyclicZombie (fst rv'b) (cte_map slot); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> corres dc (?P92 rv rv' s' rva rv'a s'a rvb) (?P'96 rv rv' s' rva rv'a s'a rv'b) (set_cap (fst rvb) slot) (updateCap (cte_map slot) (fst rv'b))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> ?P92 rv rv' s' rva rv'a s'a rvb x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> ?P'96 rv rv' s' rva rv'a s'a rv'b x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> capCyclicZombie (fst rv'b) (cte_map slot); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> cap_relation (fst rvb) (fst rv'b)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> capCyclicZombie (fst rv'b) (cte_map slot); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> is_zombie (fst rvb) \<or> is_cnode_cap (fst rvb) \<or> is_thread_cap (fst rvb)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> capCyclicZombie (fst rv'b) (cte_map slot); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> is_zombie (fst rvb) \<or> is_cnode_cap (fst rvb) \<or> is_thread_cap (fst rvb)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b x111 x112 x113. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> cap_removeable (fst rvb) slot; cap_relation (fst rvb) (fst rv'b); cap_relation (snd rvb) (snd rv'b); \<not> capRemovable (fst rv'b) (cte_map slot); capCyclicZombie (fst rv'b) (cte_map slot); fst rvb = cap.Zombie x111 x112 x113; (x111, replicate (zombie_cte_bits x112) False) = slot \<and> \<not> exposed\<rbrakk> \<Longrightarrow> is_zombie (fst rvb) \<or> is_cnode_cap (fst rvb) \<or> is_thread_cap (fst rvb)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_corres s'b (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?Q94 rv rv' s' rva rv'a s'a rvb) (?Q'98 rv rv' s' rva rv'a s'a rv'b) (doE y <- without_preemption (set_cap (fst rvb) slot);
y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- withoutPreemption (updateCap (cte_map slot) (fst rv'b));
y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?Q94 rv rv' s' rva rv'a s'a rvb x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> ?Q'98 rv rv' s' rva rv'a s'a rv'b x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'198 rv rv' s' rva rv'a s'a rvb rv'b s'b) (?P199 rv rv' s' rva rv'a s'a rvb) (?P'201 rv rv' s' rva rv'a s'a rv'b) (without_preemption (set_cap (fst rvb) slot)) (withoutPreemption (updateCap (cte_map slot) (fst rv'b)))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); ?r'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (doE y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (?P199 rv rv' s' rva rv'a s'a rvb and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (?P'201 rv rv' s' rva rv'a s'a rv'b and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (?P199 rv rv' s' rva rv'a s'a rvb and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (?P'201 rv rv' s' rva rv'a s'a rv'b and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 10. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> (exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> corres (?r'198 rv rv' s' rva rv'a s'a rvb rv'b s'b) (?P199 rv rv' s' rva rv'a s'a rvb) (?P'201 rv rv' s' rva rv'a s'a rv'b) (set_cap (fst rvb) slot) (updateCap (cte_map slot) (fst rv'b))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); ?r'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (doE y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (?P199 rv rv' s' rva rv'a s'a rvb and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (?P'201 rv rv' s' rva rv'a s'a rv'b and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (?P199 rv rv' s' rva rv'a s'a rvb and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (?P'201 rv rv' s' rva rv'a s'a rv'b and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 10. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> (exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> is_zombie (fst rvb) \<or> is_cnode_cap (fst rvb) \<or> is_thread_cap (fst rvb)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (doE y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 10. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (doE y <- rec_del (ReduceZombieCall (fst rvb) slot exposed);
y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- reduceZombie (fst rv'b) (cte_map slot) exposed;
y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>?R198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>?R'198 rv rv' s' rva rv'a s'a rvb rv'b s'b\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> ?r'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c) (?P274 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?P'276 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) (reduceZombie (fst rv'b) (cte_map slot) exposed)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ?r'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. ?P274 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. ?P'276 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> spec_corres s'c (dc \<oplus> ?r283 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c) (?P274 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc) (?P'276 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c) (rec_del (ReduceZombieCall (fst rvb) slot exposed)) (liftME (\<lambda>v. (True, capability.NullCap)) (reduceZombie (fst rv'b) (cte_map slot) exposed))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); (?r283 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. ?P274 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. ?P'276 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> liftME (\<lambda>v. (True, capability.NullCap)) (reduceZombie (fst rv'b) (cte_map slot) exposed) \<in> rec_del_concrete (ReduceZombieCall (fst rvb) slot exposed)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c x111 x112 x113. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); fst rv'b = capability.Zombie x111 (zbits_map x112) x113 \<and> cap_relation (snd rvb) (snd rv'b); 0 < x113 \<and> (x113 = Suc 0 \<longrightarrow> (x111, replicate (zombie_cte_bits x112) False) \<noteq> slot) \<and> (cap_cyclic_zombie (cap.Zombie x111 x112 x113) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (capability.Zombie x111 (zbits_map x112) x113) (cte_map slot)); \<not> capRemovable (capability.Zombie x111 (zbits_map x112) x113) (cte_map slot); exposed \<or> \<not> capCyclicZombie (capability.Zombie x111 (zbits_map x112) x113) (cte_map slot); ((), s'c) \<in> fst (set_cap (cap.Zombie x111 x112 x113) slot s'b); fst rvb = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> \<not> red_zombie_will_fail (cap.Zombie x111 x112 x113)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c x12. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); (\<exists>a'. acap_relation x12 a' \<and> fst rv'b = capability.ArchObjectCap a') \<and> cap_relation (snd rvb) (snd rv'b); (\<exists>v0 v1 v2. fst rv'b = capability.Zombie v0 v1 v2) \<or> fst rv'b = capability.NullCap; \<not> cap_removeable (cap.ArchObjectCap x12) slot \<and> (cap_cyclic_zombie (cap.ArchObjectCap x12) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> capRemovable (fst rv'b) (cte_map slot); exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot); ((), s'c) \<in> fst (set_cap (cap.ArchObjectCap x12) slot s'b); fst rvb = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> False
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 10. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c x111 x112 nat. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); fst rv'b = capability.Zombie x111 (zbits_map x112) nat \<and> cap_relation (snd rvb) (snd rv'b); 0 < nat \<and> (nat = Suc 0 \<longrightarrow> (x111, replicate (zombie_cte_bits x112) False) \<noteq> slot) \<and> (cap_cyclic_zombie (cap.Zombie x111 x112 nat) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (capability.Zombie x111 (zbits_map x112) nat) (cte_map slot)); \<not> capRemovable (capability.Zombie x111 (zbits_map x112) nat) (cte_map slot); exposed \<or> \<not> capCyclicZombie (capability.Zombie x111 (zbits_map x112) nat) (cte_map slot); ((), s'c) \<in> fst (set_cap (cap.Zombie x111 x112 nat) slot s'b); fst rvb = cap.Zombie x111 x112 nat\<rbrakk> \<Longrightarrow> \<not> red_zombie_will_fail (cap.Zombie x111 x112 nat)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c x12. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); (\<exists>a'. acap_relation x12 a' \<and> fst rv'b = capability.ArchObjectCap a') \<and> cap_relation (snd rvb) (snd rv'b); (\<exists>v0 v1 v2. fst rv'b = capability.Zombie v0 v1 v2) \<or> fst rv'b = capability.NullCap; \<not> cap_removeable (cap.ArchObjectCap x12) slot \<and> (cap_cyclic_zombie (cap.ArchObjectCap x12) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> capRemovable (fst rv'b) (cte_map slot); exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot); ((), s'c) \<in> fst (set_cap (cap.ArchObjectCap x12) slot s'b); fst rvb = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> False
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 10. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c x12. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); (\<exists>a'. acap_relation x12 a' \<and> fst rv'b = capability.ArchObjectCap a') \<and> cap_relation (snd rvb) (snd rv'b); (\<exists>v0 v1 v2. fst rv'b = capability.Zombie v0 v1 v2) \<or> fst rv'b = capability.NullCap; \<not> cap_removeable (cap.ArchObjectCap x12) slot \<and> (cap_cyclic_zombie (cap.ArchObjectCap x12) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> capRemovable (fst rv'b) (cte_map slot); exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot); ((), s'c) \<in> fst (set_cap (cap.ArchObjectCap x12) slot s'b); fst rvb = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> False
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> spec_corres s'd (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd) (?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd) (doE y <- preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE) (doE y <- preemptionPoint;
finaliseSlot' (cte_map slot) exposed
odE)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>?R273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>?R'273 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd rve rv'e s'e. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd; (Inr rve, s'e) \<in> fst (preemption_point s'd); dc rve rv'e\<rbrakk> \<Longrightarrow> spec_corres s'e (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (?R318 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd rve) (?R'318 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd rv'e) (rec_del (FinaliseSlotCall slot exposed)) (finaliseSlot' (cte_map slot) exposed)
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd\<rbrace> preemption_point \<lbrace>?R318 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace> preemptionPoint \<lbrace>?R'318 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and ?Q319 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and ?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 10. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd\<rbrace> preemption_point \<lbrace>\<lambda>rve. einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace> preemptionPoint \<lbrace>\<lambda>rv'e. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and ?Q319 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and ?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> irq_state_independent_A (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd f s. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (work_units_completed_update f s) = (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rvd rv'd s'd. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c; (Inr rvd, s'd) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) s'c); ((case ReduceZombieCall (fst rvb) slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rvd \<circ> (\<lambda>v. (True, capability.NullCap))) rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace> preemptionPoint \<lbrace>\<lambda>rv'e. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and ?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 10. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c ab bb s'd. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> cap_removeable a slot; cap_cyclic_zombie a slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap a slot s'b); (Inr (ab, bb), s'd) \<in> fst (rec_del (ReduceZombieCall a slot exposed) s'c); cap_relation a aa; cap_relation b ba; \<not> capRemovable aa (cte_map slot); exposed \<or> \<not> capCyclicZombie aa (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'320 rv rv' s' rva rv'a s'a (a, b) (aa, ba) s'b () () s'c ()\<rbrace> preemptionPoint \<lbrace>\<lambda>rv'e. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and ?Q'320 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c rv'd\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c ab bb s'd f s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> cap_removeable a slot; cap_cyclic_zombie a slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap a slot s'b); (Inr (ab, bb), s'd) \<in> fst (rec_del (ReduceZombieCall a slot exposed) s'c); cap_relation a aa; cap_relation b ba; \<not> capRemovable aa (cte_map slot); exposed \<or> \<not> capCyclicZombie aa (cte_map slot)\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s)) (ksWorkUnitsCompleted_update f s) = (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s)) s
 2. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c ab bb s'd. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> cap_removeable a slot; cap_cyclic_zombie a slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap a slot s'b); (Inr (ab, bb), s'd) \<in> fst (rec_del (ReduceZombieCall a slot exposed) s'c); cap_relation a aa; cap_relation b ba; \<not> capRemovable aa (cte_map slot); exposed \<or> \<not> capCyclicZombie aa (cte_map slot)\<rbrakk> \<Longrightarrow> irq_state_independent_H (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 9. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c ab bb s'd. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> cap_removeable a slot; cap_cyclic_zombie a slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap a slot s'b); (Inr (ab, bb), s'd) \<in> fst (rec_del (ReduceZombieCall a slot exposed) s'c); cap_relation a aa; cap_relation b ba; \<not> capRemovable aa (cte_map slot); exposed \<or> \<not> capCyclicZombie aa (cte_map slot)\<rbrakk> \<Longrightarrow> irq_state_independent_H (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 8. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 10. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. (\<lambda>_. True) and (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True))\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 10. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> (exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap (fst rvb) slot s'b)\<rbrakk> \<Longrightarrow> \<lbrace>?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b ()\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rvd. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot and emptyable slot and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b rvc rv'c s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, s'c) \<in> fst (without_preemption (set_cap (fst rvb) slot) s'b); dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv'd. (\<lambda>_. True) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q275 rv rv' s' rva rv'a s'a rvb rv'b s'b rvc\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'277 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 7. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 9. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 10. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> (exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s'c) \<in> fst (set_cap (fst rvb) slot s'b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'411 rv rv' s' rva rv'a s'a rvb rv'b s'b ()\<rbrace> reduceZombie (fst rv'b) (cte_map slot) exposed \<lbrace>\<lambda>rv s. sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc. einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>a. (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) a \<and> valid_list a \<and> (valid_sched and simple_sched_action) a \<and> simple_sched_action a \<and> cte_wp_at (\<lambda>_. True) slot a \<and> (invs and (cte_wp_at ((=) (fst rvb)) slot and is_final_cap' (fst rvb) and (\<lambda>y. is_zombie (fst rvb))) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. \<not> cap_removeable (fst rvb) slot \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s))) a \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable slot and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and K (\<not> cap_removeable (fst rvb) slot) and (\<lambda>s. \<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) a)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. True \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> ?P'411 rv rv' s' rva rv'a s'a rvb rv'b s'b rv'c s)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 6. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 8. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 9. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 10. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> without_preemption (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) s \<and> cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and> emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and> (\<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) \<and> (case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (invs and (cte_wp_at ((=) (fst rvb)) slot and is_final_cap' (fst rvb) and (\<lambda>y. is_zombie (fst rvb))) and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and emptyable slot and (\<lambda>s. \<not> cap_removeable (fst rvb) slot \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s))) s \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable slot and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and K (\<not> cap_removeable (fst rvb) slot) and (\<lambda>s. \<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) s\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. True \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot) \<and> (exposed \<or> \<not> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<lbrace>?Q200 rv rv' s' rva rv'a s'a rvb\<rbrace> liftE (set_cap (fst rvb) slot) \<lbrace>\<lambda>rvc s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. True \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and ?Q200 rv rv' s' rva rv'a s'a rvb) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 5. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 7. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 8. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 9. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 10. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> withoutPreemption (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed))) s) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. True \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> (invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 rv rv' s' rva rv'a s'a rv'b\<rbrace> liftE (updateCap (cte_map slot) (fst rv'b)) \<lbrace>\<lambda>rv'c. (\<lambda>a. invs' a \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) a) \<and> (\<exists>cp'. cap_relation (fst rvb) cp' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map slot) a \<and> \<not> capRemovable cp' (cte_map slot) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie cp' (cte_map slot)))) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and ?Q'202 rv rv' s' rva rv'a s'a rv'b) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<lbrace>?P'718 rv rv' s' rva rv'a s'a rv'b\<rbrace> updateCap (cte_map slot) (fst rv'b) \<lbrace>\<lambda>rv s. (\<exists>cp'. cap_relation (fst rvb) cp' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map slot) s \<and> \<not> capRemovable cp' (cte_map slot) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie cp' (cte_map slot))) \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; cap_relation (fst rvb) (fst rv'b); cap_relation (snd rvb) (snd rv'b); cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot); (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))\<rbrakk> \<Longrightarrow> \<lbrace>?P'718 rv rv' s' rva rv'a s'a rv'b\<rbrace> updateCap (cte_map slot) (fst rv'b) \<lbrace>\<lambda>r s. (\<exists>x. fst rv'b = x \<and> cte_wp_at' (\<lambda>cte. cteCap cte = x) (cte_map slot) s \<and> \<not> capRemovable x (cte_map slot) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie x (cte_map slot))) \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (rvb, s'b) \<in> fst (finalise_cap rv rva s'a); isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap; \<not> capRemovable (fst rv'b) (cte_map slot); cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; cap_relation (fst rvb) (fst rv'b); cap_relation (snd rvb) (snd rv'b); \<not> cap_removeable (fst rvb) slot; (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))\<rbrakk> \<Longrightarrow> \<lbrace>?P'718 rv rv' s' rva rv'a s'a rv'b\<rbrace> updateCap (cte_map slot) (fst rv'b) \<lbrace>\<lambda>r s. cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ?P'718 rv rv' s' rva rv'a s'a rv'b s)) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb rv'b s'b s'c. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (Inr rvb, s'b) \<in> fst (without_preemption (finalise_cap rv rva) s'a); cap_relation (fst rvb) (fst rv'b) \<and> cap_relation (snd rvb) (snd rv'b); isZombie (fst rv'b) \<or> isNullCap (fst rv'b); ((\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)) s'b; (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s'c) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) s'c)); (s'b, s'c) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_removeable (fst rvb) slot = capRemovable (fst rv'b) (cte_map slot) \<and> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> capRemovable aa (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie aa (cte_map slot) \<longrightarrow> invs' s'c) \<and> (exposed \<longrightarrow> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c) \<and> (\<not> capCyclicZombie aa (cte_map slot) \<longrightarrow> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c); (s'b, s'c) \<in> state_relation; cap_relation a aa; cap_relation b ba; \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s'b \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s'b) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s'b \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s'b \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> emptyable slot s'b \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> emptyable slot s'b \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> emptyable slot s'b \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> emptyable slot s'b \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b)); invs s'b; cte_wp_at (\<lambda>_. True) slot s'b; s'b \<turnstile> a\<rbrakk> \<Longrightarrow> cap_removeable a slot = capRemovable aa (cte_map slot) \<and> (cap_cyclic_zombie a slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie aa (cte_map slot))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b aa ba s'b s'c. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ((a, b), s'b) \<in> fst (finalise_cap rv rva s'a); isZombie aa \<or> aa = capability.NullCap; \<not> capRemovable aa (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie aa (cte_map slot) \<longrightarrow> invs' s'c) \<and> (exposed \<longrightarrow> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c) \<and> (\<not> capCyclicZombie aa (cte_map slot) \<longrightarrow> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'c \<and> invs' s'c \<and> valid_cap' aa s'c \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s'c)) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr aa \<and> capBits (cteCap cte) = capBits aa \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s'c) - cte_refs' aa (irq_node' s'c). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s'c) \<and> (isZombie aa \<or> isThreadCap aa \<or> is_cnode_cap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s'c \<and> bound_tcb_at' ((=) None) p s'c \<and> obj_at' (Not \<circ> tcbQueued) p s'c \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s'c (a, b))))) (cte_map slot) s'c \<and> sch_act_simple s'c \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'c \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s'c) \<longrightarrow> cte_map slot \<in> cte_refs' aa (irq_node' s'c)) (cte_map slot) s'c) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = aa) \<circ> cteCap_update (\<lambda>y. aa)) (cte_map slot) s'c); (s'b, s'c) \<in> state_relation; cap_relation b ba; \<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s'b \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s'b) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s'b \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s'b \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> emptyable slot s'b \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> emptyable slot s'b \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> emptyable slot s'b \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b) \<and> cte_wp_at (replaceable s'b slot a) slot s'b \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s'b \<and> is_final_cap' a s'b \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s'b \<and> is_zombie a \<and> emptyable slot s'b \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s'b) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s'b) \<and> cap_irqs a = {}) slot s'b \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s'b) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s'b)); invs s'b; cte_wp_at (\<lambda>_. True) slot s'b; s'b \<turnstile> a; cap_removeable a slot = capRemovable aa (cte_map slot) \<and> cap_cyclic_zombie a slot = capCyclicZombie aa (cte_map slot)\<rbrakk> \<Longrightarrow> cap_removeable a slot = capRemovable aa (cte_map slot) \<and> (cap_cyclic_zombie a slot \<and> \<not> exposed) = (\<not> exposed \<and> capCyclicZombie aa (cte_map slot))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> without_preemption (finalise_cap rv rva) \<lbrace>\<lambda>rvb. (\<lambda>x. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs x \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c x \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot x) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ((\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) and (\<lambda>s. (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> ((\<lambda>s. if slot = slot then True else cte_wp_at (\<lambda>a. True) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> (invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb) \<and> ((\<lambda>s. if slot = slot then fst rvb = fst rvb else cte_wp_at ((=) (fst rvb)) slot s) and cte_wp_at (\<lambda>_. True) slot) s \<and> (is_final_cap' (fst rvb) and cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c \<noteq> {} \<or> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {} \<or> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot) s \<and> is_zombie (fst rvb) \<and> (emptyable slot and cte_wp_at (\<lambda>_. True) slot) s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) x))) and (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb)\<rbrace>, -
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>rvb s. (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) \<and> invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 rv rv' s' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q922 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ?Q922 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) \<and> invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and ?Q46 rv rv' s' rva\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P927 rv rv' s' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>fin s. einvs s \<and> simple_sched_action s \<and> replaceable s slot (fst fin) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst fin \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst fin). halted_if_tcb t s)\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'928 rv rv' s' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'925 rv rv' s' rva rv'a s'a\<rbrace>
 3. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (einvs s \<and> simple_sched_action s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> ?Q'925 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) \<and> invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb
 4. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ?P927 rv rv' s' rva s \<and> ?P'928 rv rv' s' rva s)\<rbrace>, -
 6. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 7. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 8. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 9. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 10. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'928 rv rv' s' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'925 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (einvs s \<and> simple_sched_action s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> ?Q'925 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) \<and> invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> ?P'928 rv rv' s' rva s)\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (einvs s \<and> simple_sched_action s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) \<and> (fst rvb = cap.NullCap \<and> snd rvb = (if rva then cap_cleanup_opt rv else cap.NullCap) \<and> (snd rvb \<noteq> cap.NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie (fst rvb) \<and> is_final_cap' rv s \<and> is_final_cap' (fst rvb) s \<and> snd rvb = cap.NullCap \<and> appropriate_cte_cap (fst rvb) = appropriate_cte_cap rv \<and> cte_refs (fst rvb) = cte_refs rv \<and> gen_obj_refs (fst rvb) = gen_obj_refs rv \<and> obj_size (fst rvb) = obj_size rv \<and> fst_cte_ptrs (fst rvb) = fst_cte_ptrs rv \<and> vs_cap_ref rv = None)\<rbrakk> \<Longrightarrow> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (fst rvb) \<and> obj_size c = obj_size (fst rvb)) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. cap_irqs (fst rvb) \<inter> cap_irqs c = {} \<longrightarrow> obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs (fst rvb) \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s))) \<and> invs s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> s \<turnstile> fst rvb
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; cte_wp_at ((=) rv) slot s; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; a = cap.NullCap \<and> b = (if rva then cap_cleanup_opt rv else cap.NullCap) \<and> (b \<noteq> cap.NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = cap.NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))) \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; cte_wp_at ((=) rv) slot s; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; a = cap.NullCap \<and> b = (if rva then cap_cleanup_opt rv else cap.NullCap) \<and> (b \<noteq> cap.NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = cap.NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; ex_cte_cap_wp_to (\<lambda>cap. \<exists>cap'. rv = cap' \<and> appropriate_cte_cap cap' cap) slot s\<rbrakk> \<Longrightarrow> (\<not> cap_removeable a slot \<longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of a \<and> obj_size c = obj_size a) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> cte_wp_at (replaceable s slot a) slot s \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' a s \<and> cte_wp_at (\<lambda>c. cap_irqs a \<inter> cap_irqs c = {} \<longrightarrow> obj_refs a \<inter> obj_refs c = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs c \<noteq> {}) slot s \<and> is_zombie a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))) \<and> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; a = cap.NullCap \<and> b = (if rva then cap_cleanup_opt rv else cap.NullCap) \<and> (b \<noteq> cap.NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = cap.NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<not> cap_removeable a slot\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<not> cap_removeable a slot; a = cap.NullCap \<and> b = (if rva then cap_cleanup_opt rv else cap.NullCap) \<and> (b \<noteq> cap.NullCap \<longrightarrow> is_final_cap' rv s)\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<not> cap_removeable a slot; is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = cap.NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 3. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; emptyable slot s; \<forall>t\<in>obj_refs a. halted_if_tcb t s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<not> cap_removeable a slot; is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = cap.NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> is_final_cap' rv s \<and> obj_ref_of rv = obj_ref_of a \<and> obj_size rv = obj_size a \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> a \<noteq> cap.NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (cap_irqs a \<inter> cap_irqs rv = {} \<longrightarrow> obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> arch_gen_refs a \<inter> arch_gen_refs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a s r b n. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot (cap.Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> cap.Zombie r b n; emptyable slot s; halted_if_tcb r s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; is_final_cap' (cap.Zombie r b n) s; vs_cap_ref rv = None; cte_refs (cap.Zombie r b n) = cte_refs rv; appropriate_cte_cap (cap.Zombie r b n) = appropriate_cte_cap rv; fst_cte_ptrs (cap.Zombie r b n) = fst_cte_ptrs rv; gen_obj_refs (cap.Zombie r b n) = gen_obj_refs rv; (case b of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; 0 < n; n = Suc 0 \<longrightarrow> (r, replicate (zombie_cte_bits b) False) \<noteq> slot\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (cap.Zombie r b n) slot \<longrightarrow> obj_ref_of rv = r \<and> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv)) \<and> ((cap_cyclic_zombie (cap.Zombie r b n) slot \<longrightarrow> exposed) \<longrightarrow> obj_ref_of rv = r \<and> r \<in> obj_refs rv \<and> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a s r b n. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs s; valid_list s; valid_sched s; simple_sched_action s; replaceable s slot (cap.Zombie r b n) rv; caps_of_state s slot = Some rv; s \<turnstile> cap.Zombie r b n; emptyable slot s; halted_if_tcb r s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; is_final_cap' (cap.Zombie r b n) s; vs_cap_ref rv = None; cte_refs (cap.Zombie r b n) = cte_refs rv; appropriate_cte_cap (cap.Zombie r b n) = appropriate_cte_cap rv; fst_cte_ptrs (cap.Zombie r b n) = fst_cte_ptrs rv; gen_obj_refs (cap.Zombie r b n) = gen_obj_refs rv; (case b of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; 0 < n; n = Suc 0 \<longrightarrow> (r, replicate (zombie_cte_bits b) False) \<noteq> slot; appropriate_cte_cap rv = (\<lambda>cap. cap_irqs cap = {})\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (cap.Zombie r b n) slot \<longrightarrow> obj_ref_of rv = r \<and> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv)) \<and> ((cap_cyclic_zombie (cap.Zombie r b n) slot \<longrightarrow> exposed) \<longrightarrow> obj_ref_of rv = r \<and> r \<in> obj_refs rv \<and> (is_zombie rv \<or> is_cnode_cap rv \<or> is_thread_cap rv) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (Inr rva, s'a) \<in> fst (without_preemption (is_final_cap rv) s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv') rv'a False) \<lbrace>\<lambda>rv'b. (\<lambda>x. (capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> True) \<and> (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' x) \<and> (\<not> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot)) \<longrightarrow> (invs' and (\<lambda>s. (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (\<not> exposed \<longrightarrow> \<not> capCyclicZombie (fst rv'b) (cte_map slot)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s)) \<and> ((cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>_. True) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) \<and> (invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) (cte_map slot) s) \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> (cte_map slot = cte_map slot \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (K (fst rv'b))) (cte_map slot) s) \<and> (cte_map slot \<noteq> cte_map slot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rv'b) (cte_map slot) s))) x))) and (\<lambda>s. isZombie (fst rv'b) \<or> isNullCap (fst rv'b))\<rbrace>, -
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>\<lambda>rv'b s. (\<not> capRemovable (fst rv'b) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rv'b) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rv'b) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rv'b) \<and> capBits (cteCap cte) = capBits (fst rv'b) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rv'b) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rv'b) \<or> isThreadCap (fst rv'b) \<or> isCNodeCap (fst rv'b)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rv'b) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rv'b) \<circ> cteCap_update (\<lambda>y. fst rv'b)) (cte_map slot) s)) \<and> (isZombie (fst rv'b) \<or> fst rv'b = capability.NullCap)\<rbrace>
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'48 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q1044 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; ?Q1044 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and ?Q'48 rv rv' s' rv'a\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P1049 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> valid_cap' (fst fin) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'1050 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q'1047 rv rv' s' rva rv'a s'a\<rbrace>
 3. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (invs' s \<and> sch_act_simple s \<and> valid_cap' (fst rvb) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> ?Q'1047 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ?P1049 rv rv' s' rv'a s \<and> ?P'1050 rv rv' s' rv'a s)\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'1050 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q'1047 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (invs' s \<and> sch_act_simple s \<and> valid_cap' (fst rvb) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> ?Q'1047 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> ?P'1050 rv rv' s' rv'a s)\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P1082 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q1081 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'1083 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q'1081 rv rv' s' rva rv'a s'a\<rbrace>
 3. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (invs' s \<and> sch_act_simple s \<and> valid_cap' (fst rvb) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> ?Q1081 rv rv' s' rva rv'a s'a rvb s \<and> ?Q'1081 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 5. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> ?P1082 rv rv' s' rv'a s \<and> ?P'1083 rv rv' s' rv'a s)\<rbrace>, -
 6. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 7. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 8. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 9. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'1083 rv rv' s' rv'a\<rbrace> global.finaliseCap (cteCap rv') rv'a False \<lbrace>?Q'1081 rv rv' s' rva rv'a s'a\<rbrace>
 2. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (invs' s \<and> sch_act_simple s \<and> valid_cap' (fst rvb) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (isNullCap (fst rvb) \<and> removeable' (cte_map slot) s (cteCap rv') \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> snd rvb = cteCap rv' \<and> cap_has_cleanup' (cteCap rv') \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<or> isZombie (fst rvb) \<and> snd rvb = capability.NullCap \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) \<and> capClass (cteCap rv') = capClass (fst rvb) \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv') \<and> capBits (fst rvb) = capBits (cteCap rv') \<and> capRange (fst rvb) = capRange (cteCap rv') \<and> (isThreadCap (cteCap rv') \<or> isCNodeCap (cteCap rv') \<or> isZombie (cteCap rv')) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) \<and> ?Q'1081 rv rv' s' rva rv'a s'a rvb s\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> ?P'1083 rv rv' s' rv'a s)\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a rvb s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; (invs' s \<and> sch_act_simple s \<and> valid_cap' (fst rvb) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (isNullCap (fst rvb) \<and> removeable' (cte_map slot) s (cteCap rv') \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> snd rvb = cteCap rv' \<and> cap_has_cleanup' (cteCap rv') \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<or> isZombie (fst rvb) \<and> snd rvb = capability.NullCap \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) \<and> capClass (cteCap rv') = capClass (fst rvb) \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv') \<and> capBits (fst rvb) = capBits (cteCap rv') \<and> capRange (fst rvb) = capRange (cteCap rv') \<and> (isThreadCap (cteCap rv') \<or> isCNodeCap (cteCap rv') \<or> isZombie (cteCap rv')) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) \<and> (fst rvb \<noteq> capability.NullCap \<longrightarrow> cte_refs' (fst rvb) = cte_refs' (cteCap rv'))\<rbrakk> \<Longrightarrow> (\<not> capRemovable (fst rvb) (cte_map slot) \<longrightarrow> (\<not> exposed \<and> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s) \<and> (exposed \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s) \<and> (\<not> capCyclicZombie (fst rvb) (cte_map slot) \<longrightarrow> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> sch_act_simple s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' (fst rvb) (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) (cte_map slot) s)) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs' s; sch_act_simple s; valid_cap' a s; exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s; a = capability.NullCap \<and> removeable' (cte_map slot) s (cteCap rv') \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv' \<and> cap_has_cleanup' (cteCap rv') \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<or> isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) \<and> capClass (cteCap rv') = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv') \<and> capBits a = capBits (cteCap rv') \<and> capRange a = capRange (cteCap rv') \<and> (isThreadCap (cteCap rv') \<or> is_cnode_cap rv \<or> isZombie (cteCap rv')) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b)))); a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv')\<rbrakk> \<Longrightarrow> (\<not> capRemovable a (cte_map slot) \<longrightarrow> (exposed \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s) \<and> (\<not> capCyclicZombie a (cte_map slot) \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s)) \<and> (isZombie a \<or> a = capability.NullCap)
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs' s; sch_act_simple s; valid_cap' a s; exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv'); a = capability.NullCap \<and> removeable' (cte_map slot) s (cteCap rv') \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv' \<and> cap_has_cleanup' (cteCap rv') \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))\<rbrakk> \<Longrightarrow> (\<not> capRemovable a (cte_map slot) \<longrightarrow> (exposed \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s) \<and> (\<not> capCyclicZombie a (cte_map slot) \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s)) \<and> (isZombie a \<or> a = capability.NullCap)
 2. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs' s; sch_act_simple s; valid_cap' a s; exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv'); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) \<and> capClass (cteCap rv') = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv') \<and> capBits a = capBits (cteCap rv') \<and> capRange a = capRange (cteCap rv') \<and> (isThreadCap (cteCap rv') \<or> is_cnode_cap rv \<or> isZombie (cteCap rv')) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))\<rbrakk> \<Longrightarrow> (\<not> capRemovable a (cte_map slot) \<longrightarrow> (exposed \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s) \<and> (\<not> capCyclicZombie a (cte_map slot) \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s)) \<and> (isZombie a \<or> a = capability.NullCap)
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 4. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 5. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 6. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 7. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 8. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a a b s. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs' s; sch_act_simple s; valid_cap' a s; exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv'); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) \<and> capClass (cteCap rv') = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv') \<and> capBits a = capBits (cteCap rv') \<and> capRange a = capRange (cteCap rv') \<and> (isThreadCap (cteCap rv') \<or> is_cnode_cap rv \<or> isZombie (cteCap rv')) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))\<rbrakk> \<Longrightarrow> (\<not> capRemovable a (cte_map slot) \<longrightarrow> (exposed \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s) \<and> (\<not> capCyclicZombie a (cte_map slot) \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) (cte_map slot) (cteCaps_of s)) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' a (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) (cte_map slot) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cte_map slot \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> cte_map slot \<in> cte_refs' a (irq_node' s)) (cte_map slot) s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) (cte_map slot) s)) \<and> (isZombie a \<or> a = capability.NullCap)
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' s' rva rv'a s'a s cte bits num. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; (rva, s'a) \<in> fst (is_final_cap rv s'); final_matters' (cteCap rv') \<longrightarrow> rva = rv'a; invs' s; sch_act_simple s; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv')) bits num) s; exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv')) bits num) = cte_refs' (cteCap rv'); ctes_of s (cte_map slot) = Some cte; cteCap cte = cteCap rv'; isFinal (cteCap rv') (cte_map slot) (cteCaps_of s); capClass (cteCap rv') = PhysicalClass; zBits bits = capBits (cteCap rv'); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv')) bits num) = capRange (cteCap rv'); isThreadCap (cteCap rv') \<or> is_cnode_cap rv \<or> isZombie (cteCap rv'); \<forall>p\<in>threadCapRefs (cteCap rv'). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> bound_tcb_at' ((=) None) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv')) bits num) (cte_map slot)\<rbrakk> \<Longrightarrow> (exposed \<longrightarrow> final_matters' (cteCap rv') \<and> \<not> isUntypedCap (cteCap rv')) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv')) bits num) (cte_map slot) \<longrightarrow> final_matters' (cteCap rv') \<and> \<not> isUntypedCap (cteCap rv') \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> final_matters' (cteCap rv') \<and> \<not> isUntypedCap (cteCap rv') \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> final_matters' (cteCap rv') \<and> \<not> isUntypedCap (cteCap rv') \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> final_matters' (cteCap rv') \<and> \<not> isUntypedCap (cteCap rv') \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s))
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 3. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 4. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 5. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 6. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 7. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q34 rv\<rbrace> without_preemption (is_final_cap rv) \<lbrace>\<lambda>rva. (\<lambda>s. einvs s \<and> s \<turnstile> rv \<and> (final_matters rv \<longrightarrow> rva = is_final_cap' rv s) \<and> cte_wp_at ((=) rv) slot s) and (\<lambda>s. ((invs and cte_wp_at ((=) rv) (?slot937 rv rv' s' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> (emptyable slot and invs) s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot982 rv rv' s' rva)) s) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s))\<rbrace>, -
 2. \<And>rv rv' s'. \<lbrakk>(Inr rv, s') \<in> fst (without_preemption (get_cap slot) s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'36 rv'\<rbrace> withoutPreemption (isFinalCapability rv') \<lbrace>\<lambda>rv'a. (\<lambda>s. invs' s \<and> valid_cap' (cteCap rv') s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s))) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv') and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot)) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s) \<and> (invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> rv'a = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> valid_cap' (cteCap rv') s)\<rbrace>, -
 3. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and ?Q34 rv) x)\<rbrace>, -
 4. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and ?Q'36 rv') x)\<rbrace>, -
 5. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 6. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>(rv, s') \<in> fst (get_cap slot s_); cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P'1345 rv'\<rbrace> isFinalCapability rv' \<lbrace>\<lambda>rv s. rv = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)\<rbrace>
 2. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and (\<lambda>a. invs a \<and> valid_mdb a \<and> valid_objs a \<and> sym_refs (state_refs_of a) \<and> a \<turnstile> rv \<and> emptyable slot a \<and> simple_sched_action a \<and> is_final_cap' rv a = is_final_cap' rv a \<and> valid_list a \<and> cte_wp_at (\<lambda>c. c = rv) slot a \<and> (final_matters rv \<longrightarrow> is_final_cap' rv a = is_final_cap' rv a) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap a \<and> valid_global_refs a) \<and> cte_wp_at (\<lambda>c. c = rv) (?slot1310 rv (is_final_cap' rv a)) a \<and> cte_wp_at (\<lambda>c. c = rv) (?slot1309 rv (is_final_cap' rv a)) a \<and> (is_final_cap' rv a \<longrightarrow> is_final_cap' rv a \<and> cte_wp_at (\<lambda>c. c = rv) slot a) \<and> (is_arch_cap rv \<longrightarrow> valid_arch_caps a \<and> valid_arch_state a \<and> valid_vspace_objs a \<and> pspace_aligned a) \<and> valid_sched a)) x)\<rbrace>, -
 3. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> ?P'1345 rv' s))) x)\<rbrace>, -
 4. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 5. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Q4\<rbrace> without_preemption (get_cap slot) \<lbrace>\<lambda>rv x. (rv = cap.NullCap \<longrightarrow> True) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (invs and cte_wp_at ((=) rv) slot and (\<lambda>a. invs a \<and> valid_mdb a \<and> valid_objs a \<and> sym_refs (state_refs_of a) \<and> a \<turnstile> rv \<and> emptyable slot a \<and> simple_sched_action a \<and> is_final_cap' rv a = is_final_cap' rv a \<and> valid_list a \<and> cte_wp_at (\<lambda>c. c = rv) slot a \<and> (final_matters rv \<longrightarrow> is_final_cap' rv a = is_final_cap' rv a) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap a \<and> valid_global_refs a) \<and> cte_wp_at (\<lambda>c. c = rv) (?slot1310 rv (is_final_cap' rv a)) a \<and> cte_wp_at (\<lambda>c. c = rv) (?slot1309 rv (is_final_cap' rv a)) a \<and> (is_final_cap' rv a \<longrightarrow> is_final_cap' rv a \<and> cte_wp_at (\<lambda>c. c = rv) slot a) \<and> (is_arch_cap rv \<longrightarrow> valid_arch_caps a \<and> valid_arch_state a \<and> valid_vspace_objs a \<and> pspace_aligned a) \<and> valid_sched a)) x)\<rbrace>, -
 2. \<lbrace>?Q'4\<rbrace> withoutPreemption (getCTE (cte_map slot)) \<lbrace>\<lambda>rv' x. (isNullCap (cteCap rv') \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv') \<longrightarrow> (invs' and cte_wp_at' ((=) rv') (cte_map slot) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv') s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) s \<and> (final_matters' (cteCap rv') \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv') (cte_map slot) s \<and> final_matters' (cteCap rv') \<and> isFinal (cteCap rv') (cte_map slot) (cteCaps_of s) = isFinal (cteCap rv') (cte_map slot) (cteCaps_of s)))) x)\<rbrace>, -
 3. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q4) s_
 4. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (3 subgoals):
 1. \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv' x. cteCap rv' \<noteq> capability.NullCap \<longrightarrow> invs' x \<and> sch_act_simple x \<and> valid_cap' (cteCap rv') x \<and> weak_sch_act_wf (ksSchedulerAction x) x \<and> cte_wp_at' ((=) rv') (cte_map slot) x \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) x) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv') (cte_map slot) x \<and> (final_matters' (cteCap rv') \<longrightarrow> valid_mdb' x \<and> cte_wp_at' ((=) rv') (cte_map slot) x)\<rbrace>
 2. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> cap \<noteq> cap.NullCap \<longrightarrow> invs s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> s \<turnstile> cap \<and> emptyable slot s \<and> simple_sched_action s \<and> cte_wp_at ((=) cap) slot s \<and> valid_list s \<and> cte_wp_at (\<lambda>c. c = cap) slot s \<and> (is_final_cap' cap s \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) slot s) \<and> (cap_irqs cap \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1309 cap (is_final_cap' cap s)) s \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1310 cap (is_final_cap' cap s)) s \<and> (is_arch_cap cap \<longrightarrow> valid_arch_caps s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> pspace_aligned s) \<and> valid_sched s)) s_
 3. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'4) s' proof (prove)
goal (2 subgoals):
 1. (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) s_ \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> cap \<noteq> cap.NullCap \<longrightarrow> invs s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> s \<turnstile> cap \<and> emptyable slot s \<and> simple_sched_action s \<and> cte_wp_at ((=) cap) slot s \<and> valid_list s \<and> cte_wp_at (\<lambda>c. c = cap) slot s \<and> (is_final_cap' cap s \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) slot s) \<and> (cap_irqs cap \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1309 cap (is_final_cap' cap s)) s \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1310 cap (is_final_cap' cap s)) s \<and> (is_arch_cap cap \<longrightarrow> valid_arch_caps s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> pspace_aligned s) \<and> valid_sched s)) s_
 2. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (cte_map slot) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) (cte_map slot) s))) s' proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_; cte_wp_at ((=) cap) slot s_; cap \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> valid_mdb s_ \<and> valid_objs s_ \<and> sym_refs (state_refs_of s_) \<and> s_ \<turnstile> cap \<and> cte_wp_at (\<lambda>c. c = cap) slot s_ \<and> (is_final_cap' cap s_ \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) slot s_) \<and> (cap_irqs cap \<noteq> {} \<longrightarrow> if_unsafe_then_cap s_ \<and> valid_global_refs s_) \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1309 cap (is_final_cap' cap s_)) s_ \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1310 cap (is_final_cap' cap s_)) s_ \<and> (is_arch_cap cap \<longrightarrow> valid_arch_caps s_ \<and> valid_arch_state s_ \<and> valid_vspace_objs s_ \<and> pspace_aligned s_)
 2. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (cte_map slot) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) (cte_map slot) s))) s' proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_; cte_wp_at ((=) cap) slot s_; cap \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> valid_objs s_
 2. \<And>cap. \<lbrakk>invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_; cte_wp_at ((=) cap) slot s_; cap \<noteq> cap.NullCap; \<exists>capa. cap = capa \<and> s_ \<turnstile> capa\<rbrakk> \<Longrightarrow> valid_mdb s_ \<and> valid_objs s_ \<and> sym_refs (state_refs_of s_) \<and> s_ \<turnstile> cap \<and> cte_wp_at (\<lambda>c. c = cap) slot s_ \<and> (is_final_cap' cap s_ \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) slot s_) \<and> (cap_irqs cap \<noteq> {} \<longrightarrow> if_unsafe_then_cap s_ \<and> valid_global_refs s_) \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1309 cap (is_final_cap' cap s_)) s_ \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1310 cap (is_final_cap' cap s_)) s_ \<and> (is_arch_cap cap \<longrightarrow> valid_arch_caps s_ \<and> valid_arch_state s_ \<and> valid_vspace_objs s_ \<and> pspace_aligned s_)
 3. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (cte_map slot) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) (cte_map slot) s))) s' proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s_; cte_wp_at ((=) cap) slot s_; cap \<noteq> cap.NullCap; \<exists>capa. cap = capa \<and> s_ \<turnstile> capa\<rbrakk> \<Longrightarrow> valid_mdb s_ \<and> valid_objs s_ \<and> sym_refs (state_refs_of s_) \<and> s_ \<turnstile> cap \<and> cte_wp_at (\<lambda>c. c = cap) slot s_ \<and> (is_final_cap' cap s_ \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) slot s_) \<and> (cap_irqs cap \<noteq> {} \<longrightarrow> if_unsafe_then_cap s_ \<and> valid_global_refs s_) \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1309 cap (is_final_cap' cap s_)) s_ \<and> cte_wp_at (\<lambda>c. c = cap) (?slot1310 cap (is_final_cap' cap s_)) s_ \<and> (is_arch_cap cap \<longrightarrow> valid_arch_caps s_ \<and> valid_arch_state s_ \<and> valid_vspace_objs s_ \<and> pspace_aligned s_)
 2. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (cte_map slot) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) (cte_map slot) s))) s' proof (prove)
goal (1 subgoal):
 1. \<And>s'. (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) s' \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (cte_map slot) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) (cte_map slot) s))) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>invs' s'; sch_act_simple s'; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; ctes_of s' (cte_map slot) = Some cte\<rbrakk> \<Longrightarrow> pspace_aligned' s' \<and> pspace_distinct' s' \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> valid_cap' (cteCap cte) s' \<and> weak_sch_act_wf (ksSchedulerAction s') s' \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s')) proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>invs' s'; sch_act_simple s'; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; ctes_of s' (cte_map slot) = Some cte; valid_cap' (cteCap cte) s'\<rbrakk> \<Longrightarrow> pspace_aligned' s' \<and> pspace_distinct' s' \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> valid_cap' (cteCap cte) s' \<and> weak_sch_act_wf (ksSchedulerAction s') s' \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s') \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s')) proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>C\<in>rec_del_concrete (FinaliseSlotCall slot exposed). spec_corres s_ (dc \<oplus> (case FinaliseSlotCall slot exposed of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (FinaliseSlotCall slot exposed) and cte_wp_at (\<lambda>_. True) (slot_rdcall (FinaliseSlotCall slot exposed)) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (FinaliseSlotCall slot exposed))) s) and (\<lambda>s. case FinaliseSlotCall slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (FinaliseSlotCall slot exposed)) C

goal (2 subgoals):
 1. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
goal (2 subgoals):
 1. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:


goal (2 subgoals):
 1. \<And>ptr bits n slot s. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C
 2. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s_ (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C proof (prove)
goal (1 subgoal):
 1. spec_corres s_ ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (\<lambda>a. invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) a \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot a \<and> emptyable slot a \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a \<and> halted_if_tcb ptr a) (\<lambda>a. invs' a \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) a \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (reduceZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) False)) proof (prove)
goal (1 subgoal):
 1. corres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (\<lambda>a. invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) a \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot a \<and> emptyable slot a \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a \<and> halted_if_tcb ptr a) (\<lambda>a. invs' a \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) a \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (reduceZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) False)) proof (prove)
goal (1 subgoal):
 1. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>a. invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) a \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot a \<and> emptyable slot a \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a \<and> halted_if_tcb ptr a) (\<lambda>a. invs' a \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) a \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q25 s
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'25 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) ?Q25 ?Q'25 (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'25 s'
 2. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) ?Q'25 (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cap. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n); caps_of_state s slot = Some cap\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cap. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cap c. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> ?P30 s'
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. ?P30 s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cap c. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> cte_wp_at' (?P69 s s' cap c) (?t71 s') (?s72 s')
 2. \<And>s s' cap c ca. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s; ?P69 s s' cap c ca\<rbrakk> \<Longrightarrow> ?P'70 s' ca
 3. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 4. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (?P'70 s') (?t71 s') (?s72 s') \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (5 subgoals):
 1. \<And>s s' cap c. \<lbrakk>invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 2. \<And>s s' cap c. \<lbrakk>invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 3. \<And>s s' cap c ca. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s; cap_relation c (cteCap ca)\<rbrakk> \<Longrightarrow> ?P'70 s' ca
 4. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 5. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (?P'70 s') (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cap c ca. \<lbrakk>(s, s') \<in> state_relation; invs s; invs' s'; valid_list s; sch_act_simple s'; valid_sched s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; caps_of_state s slot = Some cap; (c, s) \<in> fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s); cte_wp_at ((=) c) (ptr, replicate (zombie_cte_bits bits) False) s; cap_relation c (cteCap ca)\<rbrakk> \<Longrightarrow> ?P'70 s' ca
 2. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 3. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (?P'70 s') (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q31 s'
 2. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> ?Q31 s') (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (1 subgoal):
 1. corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot
 2. (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (1 subgoal):
 1. (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; (s, s') \<in> state_relation; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 2. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; (s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 2. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; (s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 2. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) (?s136 s s')
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s136 s s')
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> valid_objs (?s136 s s')
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_aligned (?s136 s s')
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_distinct (?s136 s s')
 6. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_map (ptr, replicate (zombie_cte_bits bits) False) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 7. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_aligned s
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_distinct s
 5. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_map (ptr, replicate (zombie_cte_bits bits) False) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 6. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> pspace_distinct s
 4. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie ptr bits (Suc n)); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_map (ptr, replicate (zombie_cte_bits bits) False) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> ptr \<noteq> cte_map slot
 5. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> state_relation; invs s; cte_wp_at' (\<lambda>ca. True) (cte_map (cte_map slot, replicate (zombie_cte_bits bits) False)) s'; valid_list s; invs' s'; valid_sched s; sch_act_simple s'; simple_sched_action s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cte_wp_at ((=) (cap.Zombie (cte_map slot) bits (Suc n))) slot s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; is_final_cap' (cap.Zombie (cte_map slot) bits (Suc n)) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie (cte_map slot) (zbits_map bits) (Suc n)) (cte_map slot) s'; is_zombie (cap.Zombie (cte_map slot) bits (Suc n)); \<not> capRemovable (capability.Zombie (cte_map slot) (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie (cte_map slot) (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb (cte_map slot) s; s \<turnstile> cap.Zombie (cte_map slot) bits (Suc n); cte_map (cte_map slot, replicate (zombie_cte_bits bits) False) \<noteq> cte_map slot; ptr = cte_map slot\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) (doE y <- assertE (ptr \<noteq> cte_map slot);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE capAtPtr <- liftE (do x <- getCTE ptr;
return (cteCap x)
od);
y <- assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (do x <- getCTE ptr;
doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE
od) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 2. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s'. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; (s, s') \<in> state_relation; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s'\<rbrakk> \<Longrightarrow> isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; pspace_relation (kheap s) (ksPSpace s'); invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (6 subgoals):
 1. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num\<rbrakk> \<Longrightarrow> cte_wp_at' ((=) (?cte214 x s s' bitsa num)) (?x214 x s s' bitsa num) s'
 2. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap (?cte214 x s s' bitsa num)) \<and> ?x214 x s s' bitsa num = cte_map slot\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 5. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (5 subgoals):
 1. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap x) \<and> ptr = cte_map slot\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 4. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s' bitsa num. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) ptr s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie ptr bitsa num; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap x) \<and> ptr = cte_map slot\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s' bitsa num c a b. \<lbrakk>(cte_map (a, b), replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_map (a, b) \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) (cte_map (a, b)) s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (cte_map (a, b), replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie (cte_map (a, b)) bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie (cte_map (a, b)) bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie (cte_map (a, b)) bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb (cte_map (a, b)) s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie (cte_map (a, b)) bitsa num; cte_wp_at ((=) c) (a, b) s; cap_relation c (capability.Zombie (cte_map (a, b)) bitsa num); ptr = cte_map (a, b)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s' bitsa num c a b x112. \<lbrakk>(cte_map (a, b), replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_map (a, b) \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) (cte_map (a, b)) s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (cte_map (a, b), replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cte_wp_at ((=) (cap.Zombie (cte_map (a, b)) bits (Suc n))) slot s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie (cte_map (a, b)) bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie (cte_map (a, b)) bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); cte_wp_at (\<lambda>_. True) slot s; \<not> capRemovable (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb (cte_map (a, b)) s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie (cte_map (a, b)) (zbits_map x112) num; cte_wp_at ((=) (cap.Zombie (cte_map (a, b)) x112 num)) (a, b) s; bitsa = zbits_map x112; ptr = cte_map (a, b); c = cap.Zombie (cte_map (a, b)) x112 num\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s s' num a b x112. \<lbrakk>(cte_map (a, b), replicate (zombie_cte_bits bits) False) \<noteq> slot; cte_map (a, b) \<noteq> cte_map slot; invs s; cte_wp_at' (\<lambda>c. c = x) (cte_map (a, b)) s'; ekheap_relation (ekheap s) (ksPSpace s'); valid_list s; cte_wp_at' (\<lambda>ca. True) (cte_map (cte_map (a, b), replicate (zombie_cte_bits bits) False)) s'; sched_act_relation (scheduler_action s) (ksSchedulerAction s'); valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (ksCurDomain s') (kheap s) (ksCurThread s') (ksIdleThread s'); invs' s'; ready_queues_relation (ready_queues s) (ksReadyQueues s'); simple_sched_action s; sch_act_simple s'; ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); fst (get_cap slot s) = {(cap.Zombie (cte_map (a, b)) bits (Suc n), s)}; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); is_final_cap' (cap.Zombie (cte_map (a, b)) bits (Suc n)) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s'; cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); is_zombie (cap.Zombie (cte_map (a, b)) bits (Suc n)); cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot) s'; revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); \<not> capRemovable (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); \<not> capCyclicZombie (capability.Zombie (cte_map (a, b)) (zbits_map bits) (Suc n)) (cte_map slot); (arch_state s, ksArchState s') \<in> arch_state_relation; emptyable slot s; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb (cte_map (a, b)) s; cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cteCap x = capability.Zombie (cte_map (a, b)) (zbits_map x112) num; fst (get_cap (a, b) s) = {(cap.Zombie (cte_map (a, b)) x112 num, s)}; ptr = cte_map (a, b)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres ((\<lambda>a b. True) \<oplus> (\<lambda>x _. True)) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot)) (doE y <- assertE (isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr);
liftE (capSwapForDelete ptr (cte_map slot))
odE)
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres (\<lambda>x _. True) (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot) (capSwapForDelete ptr (cte_map slot))
 2. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s) (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot) (capSwapForDelete ptr (cte_map slot))
 2. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> ptr = cte_map (ptr, replicate (zombie_cte_bits bits) False)
 2. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 3. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and valid_mdb and valid_list and cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) and cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. tcb_cap_valid cap (ptr, replicate (zombie_cte_bits bits) False) s) and (\<lambda>s. \<forall>cap. tcb_cap_valid cap slot s)) s
 4. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 5. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and valid_mdb and valid_list and cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) and cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. tcb_cap_valid cap (ptr, replicate (zombie_cte_bits bits) False) s) and (\<lambda>s. \<forall>cap. tcb_cap_valid cap slot s)) s
 3. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 4. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (cap.Zombie ptr bits (Suc n)) s \<and> is_zombie (cap.Zombie ptr bits (Suc n)) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and valid_mdb and valid_list and cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) and cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. tcb_cap_valid cap (ptr, replicate (zombie_cte_bits bits) False) s) and (\<lambda>s. \<forall>cap. tcb_cap_valid cap slot s)) s
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>cap. tcb_cap_valid cap slot s)
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, replicate (zombie_cte_bits bits) False) s \<and> (\<forall>cap. tcb_cap_valid cap slot s)
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (5 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> \<forall>cap. tcb_cap_valid cap slot s
 3. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 4. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s; emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> \<forall>cap. tcb_cap_valid cap slot s
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s cap. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; caps_of_state s slot = Some (cap.Zombie ptr bits (Suc n)); is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> tcb_cap_valid cap slot s
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (5 subgoals):
 1. \<And>x s cap. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> \<forall>ptra st. \<forall>(getF, setF, restr)\<in>ran tcb_cap_cases. \<not> restr ptra st (cap.Zombie ptr bits (Suc n)) \<or> (\<forall>cap. restr ptra st cap)
 2. \<And>x s cap. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> \<forall>ptra. (is_nondevice_page_cap (cap.Zombie ptr bits (Suc n)) \<or> cap.Zombie ptr bits (Suc n) = cap.NullCap) \<and> valid_ipc_buffer_cap (cap.Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap cap ptra
 3. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 4. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (4 subgoals):
 1. \<And>x s cap. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; invs s; valid_list s; valid_sched s; simple_sched_action s; is_final_cap' (cap.Zombie ptr bits (Suc n)) s; is_zombie (cap.Zombie ptr bits (Suc n)); emptyable slot s; ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; halted_if_tcb ptr s\<rbrakk> \<Longrightarrow> \<forall>ptra. (is_nondevice_page_cap (cap.Zombie ptr bits (Suc n)) \<or> cap.Zombie ptr bits (Suc n) = cap.NullCap) \<and> valid_ipc_buffer_cap (cap.Zombie ptr bits (Suc n)) ptra \<longrightarrow> valid_ipc_buffer_cap cap ptra
 2. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 3. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (3 subgoals):
 1. \<And>x s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; isZombie (cteCap x) \<longrightarrow> capZombiePtr (cteCap x) \<noteq> ptr; (cte_wp_at' (\<lambda>c. c = x) ptr and (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_distinct' and pspace_aligned') s
 2. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s' \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s' \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s' \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (getCTE ptr) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>(ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot; ptr \<noteq> cte_map slot; True; cte_wp_at' (\<lambda>ca. True) (cte_map (ptr, replicate (zombie_cte_bits bits) False)) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s \<and> \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) \<and> \<not> capCyclicZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) ptr s proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False). spec_corres s_ (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot False)) C

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)
\<lbrakk>?option = ?option'; ?option' = None \<Longrightarrow> ?f1.0 = ?g1.0; \<And>x2. ?option' = Some x2 \<Longrightarrow> ?f2.0 x2 = ?g2.0 x2\<rbrakk> \<Longrightarrow> (case ?option of None \<Rightarrow> ?f1.0 | Some x2 \<Rightarrow> ?f2.0 x2) = (case ?option' of None \<Rightarrow> ?g1.0 | Some x2 \<Rightarrow> ?g2.0 x2)

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:
(Inr ?rv, ?st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s_) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall ?rv False). spec_corres ?st (dc \<oplus> (case CTEDeleteCall ?rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall ?rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall ?rv False)) and emptyable (slot_rdcall (CTEDeleteCall ?rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall ?rv False)) s) and (\<lambda>s. case CTEDeleteCall ?rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall ?rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall ?rv False))) s) and (\<lambda>s. case CTEDeleteCall ?rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall ?rv False)) C

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (state)
this:
(Inr ?rv, ?st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s_) \<Longrightarrow> spec_corres ?st (dc \<oplus> (\<lambda>x. (case CTEDeleteCall ?rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) x \<circ> (\<lambda>x. (True, capability.NullCap)))) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall ?rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall ?rv False)) and emptyable (slot_rdcall (CTEDeleteCall ?rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall ?rv False)) s) and (\<lambda>s. case CTEDeleteCall ?rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall ?rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall ?rv False))) s) and (\<lambda>s. case CTEDeleteCall ?rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall ?rv False)) (cteDelete (cte_map ?rv) False)

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv st. (Inr rv, st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (CTEDeleteCall rv False). spec_corres st (dc \<oplus> (case CTEDeleteCall rv False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall rv False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall rv False)) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall rv False))) s) and (\<lambda>s. case CTEDeleteCall rv False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (CTEDeleteCall rv False)) C) \<Longrightarrow> \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. \<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s_ (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) (liftME (\<lambda>x. (True, capability.NullCap)) (reduceZombie (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) True)) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (1 subgoal):
 1. spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>(einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) s'; (s_, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)
 2. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)
 2. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)
 2. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> n < 2 ^ zombie_cte_bits bits
 2. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> zombie_cte_bits bits < word_bits
 3. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = ptr + word_of_nat n * 2 ^ cte_level_bits
 4. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> zombie_cte_bits bits < word_bits
 2. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = ptr + word_of_nat n * 2 ^ cte_level_bits
 3. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>(s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ptr + 2 ^ cte_level_bits * word_of_nat n = ptr + word_of_nat n * 2 ^ cte_level_bits
 2. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (1 subgoal):
 1. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and (cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n)))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)))) (doE end_slot <- returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n);
rec_del (CTEDeleteCall end_slot False);
new_cap <- without_preemption $ get_cap slot;
if new_cap = cap.Zombie ptr bits (Suc n) then without_preemption $ set_cap (cap.Zombie ptr bits n) slot else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (cap.Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) (liftME (\<lambda>x. (True, capability.NullCap)) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od)) proof (prove)
goal (1 subgoal):
 1. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (do endSlot <- locateSlotCap (capability.Zombie ptr (zbits_map bits) (Suc n)) (word_of_nat n);
doE y <- cteDelete endSlot False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE endSlot;
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> s_ \<turnstile> cap.Zombie ptr bits (Suc n)
 2. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (1 subgoal):
 1. ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) s'; (s_, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n < 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_\<rbrakk> \<Longrightarrow> n < 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> n < 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n); Suc n \<le> 2 ^ zombie_cte_bits bits\<rbrakk> \<Longrightarrow> n < 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n); n < 2 ^ zombie_cte_bits bits\<rbrakk> \<Longrightarrow> n < 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> 2 ^ zombie_cte_bits bits \<le> 2 ^ (word_bits - cte_level_bits)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> zombie_cte_bits bits \<le> word_bits - cte_level_bits
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 2
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref 3 n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map None) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map None) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr None (Suc n)) s_; is_zombie (cap.Zombie ptr None (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; bits = None; is_aligned ptr 9; 9 < word_bits; tcb_at ptr s_; n \<le> 4\<rbrakk> \<Longrightarrow> 3 \<le> word_bits - cte_level_bits
 2. \<And>s' x2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref x2 n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map (Some x2)) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map (Some x2)) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr (Some x2) (Suc n)) s_; is_zombie (cap.Zombie ptr (Some x2) (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; bits = Some x2; is_aligned ptr (cte_level_bits + x2); cte_level_bits + x2 < word_bits; cap_table_at x2 ptr s_; Suc n \<le> 2 ^ x2; 0 < x2\<rbrakk> \<Longrightarrow> x2 \<le> word_bits - cte_level_bits
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 2
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (3 subgoals):
 1. \<And>s' x2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref x2 n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map (Some x2)) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map (Some x2)) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr (Some x2) (Suc n)) s_; is_zombie (cap.Zombie ptr (Some x2) (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; bits = Some x2; is_aligned ptr (cte_level_bits + x2); cte_level_bits + x2 < word_bits; cap_table_at x2 ptr s_; Suc n \<le> 2 ^ x2; 0 < x2\<rbrakk> \<Longrightarrow> x2 \<le> word_bits - cte_level_bits
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 2
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); (s_, s') \<in> state_relation; invs s_; invs' s'; valid_list s_; sch_act_simple s'; valid_sched s_; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; simple_sched_action s_; cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s'; \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 2
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) and (\<lambda>s. \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot))) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> dc) ?Q176 ?Q'176 (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (doE y <- cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False;
do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od
odE)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> ?Q176 s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> ?Q'176 s' proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> spec_corres s_ (dc \<oplus> ?r'180) ?P180 ?P'180 (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) (cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False)
 2. \<And>rv rv' s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); ?r'180 rv rv'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (?R180 rv) (?R'180 rv') (doE new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od)
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?R180\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?R'180\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (?P180 and ?Q180) s_
 6. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (?P'180 and ?Q'180) s' proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> (Inr (ptr, nat_to_cref (zombie_cte_bits bits) n), s_) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s_)
 2. \<And>rv rv' s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); ((case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rv \<circ> (\<lambda>x. (True, capability.NullCap))) rv'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (?R180 rv) (?R'180 rv') (doE new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od)
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?R180\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?R'180\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 6. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); ((case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rv \<circ> (\<lambda>x. (True, capability.NullCap))) rv'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (?R180 rv) (?R'180 rv') (doE new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?R180\<rbrace>, -
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?R'180\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); ((case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc) rv \<circ> (\<lambda>x. (True, capability.NullCap))) rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R180 rv) (?R'180 rv') (doE new_cap <- liftE (get_cap slot);
y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?R180\<rbrace>, -
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?R'180\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (5 subgoals):
 1. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R180 rv) (?R'180 ()) (do new_cap <- get_cap slot;
doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE
od) (do ourCTE <- getCTE (cte_map slot);
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail
od)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>?R180\<rbrace>, -
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?R'180\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R190 rv s' new_cap) (?R'190 rv s' ourCTE) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>?R190 rv s'\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>?R'190 rv s'\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R190 rv s' new_cap) (?P'202 rv s' ourCTE) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>?R190 rv s'\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. ?P'202 rv s' ourCTE and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- liftE (set_cap (cap.Zombie x111 bits n) slot);
returnOk undefined
odE) (liftE (do endCTE <- getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie x111 (zbits_map bits) n)
od))
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> corres dc (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) (set_cap (cap.Zombie x111 bits n) slot) (do endCTE <- getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie x111 (zbits_map bits) n)
od)
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (10 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> corres dc (?Q211 rv s' new_cap ourCTE x111) (?Q'211 rv s' new_cap ourCTE x111) (set_cap (cap.Zombie x111 bits n) slot) (do endCTE <- getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie x111 (zbits_map bits) n)
od)
 2. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q211 rv s' new_cap ourCTE x111 s
 3. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 4. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 6. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 10. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (13 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 endCTE. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> corres dc (?Q211 rv s' new_cap ourCTE x111) (?Q'215 rv s' new_cap ourCTE x111 endCTE) (set_cap (cap.Zombie x111 bits n) slot) (do y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie x111 (zbits_map bits) n)
od)
 2. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>?Q'215 rv s' new_cap ourCTE x111\<rbrace>
 3. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 5. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q211 rv s' new_cap ourCTE x111 s
 6. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 7. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 8. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 9. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 endCTE. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); cteCap endCTE = capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (?Q211 rv s' (cap.Zombie x111 bits (Suc n)) ourCTE x111) (?P'220 rv s' (cap.Zombie x111 bits (Suc n)) ourCTE x111 endCTE) (set_cap (cap.Zombie x111 bits n) slot) (updateCap (cte_map slot) (capability.Zombie x111 (zbits_map bits) n))
 2. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>endCTE. ?P'220 rv s' new_cap ourCTE x111 endCTE and (\<lambda>s. cteCap endCTE = capability.NullCap)\<rbrace>
 3. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 5. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q211 rv s' new_cap ourCTE x111 s
 6. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 7. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 8. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 9. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 endCTE. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); cteCap endCTE = capability.NullCap\<rbrakk> \<Longrightarrow> cap_relation (cap.Zombie x111 bits n) (capability.Zombie x111 (zbits_map bits) n)
 2. \<And>rv s' new_cap ourCTE x111 endCTE. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); cteCap endCTE = capability.NullCap\<rbrakk> \<Longrightarrow> is_zombie (cap.Zombie x111 bits n) \<or> is_cnode_cap (cap.Zombie x111 bits n) \<or> is_thread_cap (cap.Zombie x111 bits n)
 3. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>endCTE. invs' and (\<lambda>s. cteCap endCTE = capability.NullCap)\<rbrace>
 4. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 6. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 7. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 8. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 9. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 10. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 endCTE. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); cteCap endCTE = capability.NullCap\<rbrakk> \<Longrightarrow> is_zombie (cap.Zombie x111 bits n) \<or> is_cnode_cap (cap.Zombie x111 bits n) \<or> is_thread_cap (cap.Zombie x111 bits n)
 2. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>endCTE. invs' and (\<lambda>s. cteCap endCTE = capability.NullCap)\<rbrace>
 3. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 5. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 6. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 7. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 8. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 9. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>endCTE. invs' and (\<lambda>s. cteCap endCTE = capability.NullCap)\<rbrace>
 2. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 4. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 5. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 6. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 7. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 8. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'211 rv s' new_cap ourCTE x111\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r s. cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> (invs' and (\<lambda>s. cteCap r = capability.NullCap)) s\<rbrace>
 2. \<And>rv s' new_cap ourCTE x111 s. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); ?Q'211 rv s' new_cap ourCTE x111 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (?Q'211 rv s' new_cap ourCTE x111) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 4. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 5. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?Q'211 rv s' new_cap ourCTE x111 s'a
 6. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 7. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 8. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 s saa. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> invs' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cteCap cte = capability.NullCap)); s = saa\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) saa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) saa \<and> s = saa)
 2. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> invs' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cteCap cte = capability.NullCap))) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 3. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 4. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 5. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 6. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 7. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 10. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s' new_cap ourCTE x111. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> invs' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cteCap cte = capability.NullCap))) (getCTE (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)))
 2. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 3. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 4. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 6. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 10. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of (cap.Zombie x111 bits n) \<and> obj_size c = obj_size (cap.Zombie x111 bits n)) slot s
 2. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) s'a; cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = ptr \<and> obj_size c = (case bits of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n))) slot s
 2. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (10 subgoals):
 1. \<And>a b s' ourCTE s s'a cap. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) s'a; cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a; cap = cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> is_zombie cap
 2. \<And>a b s' ourCTE s s'a. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) s'a; cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a; cte_wp_at (\<lambda>cap. is_final_cap' cap s) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = ptr \<and> obj_size c = (case bits of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n))) slot s
 3. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 4. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 6. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 9. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 10. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) s'a; cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a; cte_wp_at (\<lambda>cap. is_final_cap' cap s) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = ptr \<and> obj_size c = (case bits of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n))) slot s
 2. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE x111 s s'a. \<lbrakk>x111 + 2 ^ cte_level_bits * word_of_nat n = cte_map (x111, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie x111 (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (x111, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (x111, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); ptr = x111; cteCap ourCTE = capability.Zombie x111 (zbits_map bits) (Suc n); new_cap = cap.Zombie x111 bits (Suc n); (invs and cte_wp_at (\<lambda>c. c = cap.Zombie x111 bits (Suc n)) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (x111, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (x111, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n))) s'a; (s, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> invs' s'a \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (cte_map (x111, nat_to_cref (zombie_cte_bits bits) n)) s'a \<and> cteCap cte = capability.NullCap))
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte c. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a cte c. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; c = cap.NullCap\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>a b s' ourCTE s s'a cte c. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) cap.NullCap) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s'a\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>a b s' ourCTE s s'a cte c. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte c. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) c) (ptr, nat_to_cref (zombie_cte_bits bits) n) s; is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits ba) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits ba) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits ba) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits ba) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits ba) False) s; nat_to_cref (zombie_cte_bits bits) n = replicate (zombie_cte_bits ba) False\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits ba) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits ba) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits ba) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits ba) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits ba) False) s; nat_to_cref (zombie_cte_bits bits) n = replicate (zombie_cte_bits ba) False\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, ?c308 a b s' ourCTE s s'a cte ba na) s
 2. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits ba) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits ba) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits ba) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits ba) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits ba) False) s; nat_to_cref (zombie_cte_bits bits) n = replicate (zombie_cte_bits ba) False; length (?c308 a b s' ourCTE s s'a cte ba na) = length (replicate (zombie_cte_bits bits) False)\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits ba) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits ba) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits ba) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits ba) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits ba) False) s; nat_to_cref (zombie_cte_bits bits) n = replicate (zombie_cte_bits ba) False; length (replicate (zombie_cte_bits ba) False) = length (replicate (zombie_cte_bits bits) False)\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits bits) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits bits) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits bits) False) s; nat_to_cref (zombie_cte_bits bits) n = replicate (zombie_cte_bits bits) False; zombie_cte_bits ba = zombie_cte_bits bits\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (9 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits bits) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits bits) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits bits) False) s; zombie_cte_bits ba = zombie_cte_bits bits\<rbrakk> \<Longrightarrow> n < Suc n
 2. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits bits) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits bits) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits bits) False) s; zombie_cte_bits ba = zombie_cte_bits bits; n = 0\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 3. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 5. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 8. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 9. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, replicate (zombie_cte_bits bits) False); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n); (s, s'a) \<in> state_relation; invs s; invs' s'a; cte_wp_at (\<lambda>c. c = cap.Zombie ptr bits (Suc n)) slot s; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a (cte_map (ptr, replicate (zombie_cte_bits bits) False)) = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc n); cte_wp_at ((=) (cap.Zombie ptr ba na)) (ptr, replicate (zombie_cte_bits bits) False) s; zombie_cte_bits ba = zombie_cte_bits bits; n = 0\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr = cte_map (ptr, replicate (zombie_cte_bits bits) False); cte_map slot \<noteq> ptr; (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc 0); (s, s'a) \<in> state_relation; invs s; invs' s'a; fst (get_cap slot s) = {(cap.Zombie ptr bits (Suc 0), s)}; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a ptr = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc 0); fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s) = {(cap.Zombie ptr ba na, s)}; zombie_cte_bits ba = zombie_cte_bits bits; n = 0\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE s s'a cte ba na. \<lbrakk>ptr = cte_map (ptr, replicate (zombie_cte_bits bits) False); cte_map slot \<noteq> ptr; (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, replicate (zombie_cte_bits bits) False) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, replicate (zombie_cte_bits bits) False) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc 0); (s, s'a) \<in> state_relation; invs s; invs' s'a; sch_act_simple s'a; ctes_of s'a (cte_map slot) = Some ourCTE; ctes_of s'a ptr = Some cte; s \<turnstile> cap.Zombie ptr bits (Suc 0); fst (get_cap (ptr, replicate (zombie_cte_bits bits) False) s) = {(cap.Zombie ptr ba na, s)}; zombie_cte_bits ba = zombie_cte_bits bits; n = 0; \<not> is_zombie (cap.Zombie ptr bits (Suc 0)); \<not> is_zombie (cap.Zombie ptr ba na)\<rbrakk> \<Longrightarrow> cteCap cte = capability.NullCap
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.NullCap\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); \<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s_); cteCap ourCTE = capability.NullCap; new_cap = cap.NullCap\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (returnOk undefined) (returnOk ())
 2. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); \<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); \<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE zb na cp. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_); cap_relation new_cap (cteCap ourCTE); cteCap ourCTE = capability.Zombie (cte_map slot) zb na; cp = capability.Zombie ptr (zbits_map bits) (Suc na); capZombiePtr cp \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- if new_cap = cap.Zombie ptr bits (Suc n) then liftE (set_cap (cap.Zombie ptr bits n) slot) else assertE (new_cap = cap.NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then if ptr = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = Suc n \<and> zbits_map bits = capZombieType (cteCap ourCTE) then liftE (do endCTE <- getCTE (cte_map (capZombiePtr (cteCap ourCTE), nat_to_cref (zombie_cte_bits bits) n));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap (cte_map slot) (capability.Zombie (capZombiePtr (cteCap ourCTE)) (capZombieType (cteCap ourCTE)) n)
od) else assertE (capZombiePtr (cteCap ourCTE) = cte_map slot \<and> ptr \<noteq> cte_map slot) else fail)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s' new_cap ourCTE zb na cp x112. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s_); zb = zbits_map x112; cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; cp = capability.Zombie ptr (zbits_map bits) (Suc na); ptr \<noteq> cte_map slot; new_cap = cap.Zombie (cte_map slot) x112 na\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- assertE (is_zombie (cap.Zombie (cte_map slot) x112 na) \<and> (cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (assertE True)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>a b s' ourCTE na x112. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
y <- liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info));
returnOk undefined
odE) s_); cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> (case c of cap.Zombie x xa xb \<Rightarrow> True | _ \<Rightarrow> False) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (doE y <- assertE ((cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
returnOk undefined
odE) (assertE True)
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>a b s' ourCTE na x112. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; ptr \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> (case c of cap.Zombie x xa xb \<Rightarrow> True | _ \<Rightarrow> False) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (if (cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot then returnOk () else fail) (returnOk ())
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (8 subgoals):
 1. \<And>a b s' ourCTE na x112. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; ptr \<noteq> cte_map slot; (cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> (case c of cap.Zombie x xa xb \<Rightarrow> True | _ \<Rightarrow> False) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) (returnOk ()) (returnOk ())
 2. \<And>a b s' ourCTE na x112 s s'a. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; ptr \<noteq> cte_map slot; (s, s'a) \<in> state_relation; (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> (case c of cap.Zombie x xa xb \<Rightarrow> True | _ \<Rightarrow> False) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) s'a\<rbrakk> \<Longrightarrow> (cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 4. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 7. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 8. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (7 subgoals):
 1. \<And>a b s' ourCTE na x112 s s'a. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr (a, b), s') \<in> fst ((doE (success, cleanup_info) <- rec_del (FinaliseSlotCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
liftME (\<lambda>y. undefined) (liftE (when success (empty_slot (ptr, nat_to_cref (zombie_cte_bits bits) n) cleanup_info)))
odE) s_); cteCap ourCTE = capability.Zombie (cte_map slot) (zbits_map x112) na; ptr \<noteq> cte_map slot; (s, s'a) \<in> state_relation; (invs and cte_wp_at (\<lambda>c. c = cap.Zombie (cte_map slot) x112 na) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> (case c of cap.Zombie x xa xb \<Rightarrow> True | _ \<Rightarrow> False) \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)) s; (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n))) s'a\<rbrakk> \<Longrightarrow> (cte_map slot, replicate (zombie_cte_bits x112) False) = slot \<and> (ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 3. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 6. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 7. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (6 subgoals):
 1. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q197 rv\<rbrace> get_cap slot \<lbrace>\<lambda>new_cap. invs and cte_wp_at (\<lambda>c. c = new_cap) slot and cte_wp_at (\<lambda>c. c = cap.NullCap \<or> \<not> False \<and> is_zombie c \<and> (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> fst_cte_ptrs c) (ptr, nat_to_cref (zombie_cte_bits bits) n)\<rbrace>
 2. \<And>rv s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (Inr rv, s') \<in> fst (rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) s_)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'194 ()\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>ourCTE. invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = ourCTE) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap ourCTE = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap ourCTE = capability.NullCap \<or> (\<exists>zb n cp. cteCap ourCTE = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))\<rbrace>
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q180\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>a. cte_wp_at (\<lambda>_. True) slot and ?Q197 a\<rbrace>, -
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'194 a\<rbrace>, -
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and ?Q180) s_
 6. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>\<lambda>rv s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = cte) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))) s)\<rbrace>, -
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180\<rbrace> cteDelete (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) False \<lbrace>?Q'405\<rbrace>, -
 2. \<And>rv s. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); ?Q'405 rv s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = cte) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))) s)
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 4. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and ?Q'180) s' proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); cap = capability.Zombie ptr (zbits_map bits) (Suc n)\<rbrakk> \<Longrightarrow> isZombie cap
 2. \<And>rv s. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb na cp. cteCap cte = capability.Zombie (cte_map slot) zb na \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> (capZombiePtr cp \<noteq> cte_map slot \<or> cte_map slot = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)))) (cte_map slot)) s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = cte) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))) s)
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 4. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>rv s. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb na cp. cteCap cte = capability.Zombie (cte_map slot) zb na \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> (capZombiePtr cp \<noteq> cte_map slot \<or> cte_map slot = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)))) (cte_map slot)) s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>c. c = cte) (cte_map slot) and cte_wp_at' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) and (\<lambda>s. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n) \<or> cteCap cte = capability.NullCap \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (cte_map slot) zb n \<and> cp = capability.Zombie ptr (zbits_map bits) (Suc n) \<and> capZombiePtr cp \<noteq> cte_map slot))) s)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>2 ^ cte_level_bits * word_of_nat n = 0; n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie (cte_map slot) (zbits_map bits) (Suc n)) (cte_map slot); invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>word_of_nat n << cte_level_bits = 0; n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (5 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> cte_level_bits < LENGTH(32)
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (LENGTH(32) - cte_level_bits)
 3. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (4 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (LENGTH(32) - cte_level_bits)
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 4. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (5 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat n < ?y448 s cte zb na
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> ?y448 s cte zb na \<le> 2 ^ (LENGTH(32) - cte_level_bits)
 3. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (5 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - cte_level_bits) < 2 ^ LENGTH(32)
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ (word_bits - cte_level_bits)) \<le> 2 ^ (LENGTH(32) - cte_level_bits)
 3. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (6 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_bits - cte_level_bits < LENGTH(32)
 2. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ (word_bits - cte_level_bits)) \<le> 2 ^ (LENGTH(32) - cte_level_bits)
 4. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 5. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 6. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (5 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 1 < 2
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ (word_bits - cte_level_bits)) \<le> 2 ^ (LENGTH(32) - cte_level_bits)
 3. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 5. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (4 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ (word_bits - cte_level_bits)) \<le> 2 ^ (LENGTH(32) - cte_level_bits)
 2. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 4. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0 >> cte_level_bits\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na; word_of_nat n = 0\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>n < 2 ^ (word_bits - cte_level_bits); 0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> n < 2 ^ LENGTH(32)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - cte_level_bits) \<le> 2 ^ LENGTH(32)
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (4 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> word_bits - cte_level_bits \<le> LENGTH(32)
 2. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 1 \<le> 2
 3. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 4. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<And>s cte zb na. \<lbrakk>0 < n; invs' s; sch_act_simple s; ctes_of s (cte_map slot) = Some cte; zb = zbits_map bits \<longrightarrow> na \<noteq> Suc n; ptr = cte_map slot; cte_map slot = cte_map (cte_map slot, nat_to_cref (zombie_cte_bits bits) n); cteCap cte = capability.Zombie (cte_map slot) zb na\<rbrakk> \<Longrightarrow> 1 \<le> 2
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (einvs and simple_sched_action and cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot and is_final_cap' (cap.Zombie ptr bits (Suc n)) and (\<lambda>y. is_zombie (cap.Zombie ptr bits (Suc n))) and cte_wp_at (\<lambda>_. True) slot and emptyable slot and halted_if_tcb ptr) s_\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and cte_wp_at (\<lambda>_. True) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True) and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> (invs and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) s \<and> True \<and> True)) s_
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_\<rbrakk> \<Longrightarrow> n < Suc n
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_ \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s_
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; cte_wp_at ((=) (cap.Zombie ptr bits (Suc n))) slot s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s_
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> n < Suc n
 2. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cap_irqs (cap.Zombie ptr bits (Suc n)) = {}
 3. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs s_; valid_list s_; valid_sched s_; simple_sched_action s_; is_final_cap' (cap.Zombie ptr bits (Suc n)) s_; is_zombie (cap.Zombie ptr bits (Suc n)); cte_wp_at (\<lambda>_. True) slot s_; emptyable slot s_; halted_if_tcb ptr s_; s_ \<turnstile> cap.Zombie ptr bits (Suc n)\<rbrakk> \<Longrightarrow> cap_irqs (cap.Zombie ptr bits (Suc n)) = {}
 2. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot)) s'\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False))) s) and (\<lambda>s. case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True) and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot) s)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n)\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s' (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s' (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (2 subgoals):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'\<rbrakk> \<Longrightarrow> n < zombieCTEs (zbits_map bits)
 2. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; cte_wp_at' (\<lambda>_. True) (ptr + word_of_nat n * 2 ^ cteSizeBits) s'\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s' (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; cte_wp_at' (\<lambda>_. True) (ptr + word_of_nat n * 2 ^ cteSizeBits) s'\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s' (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (2 subgoals):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; cte_wp_at' (\<lambda>_. True) (ptr + word_of_nat n * 2 ^ cteSizeBits) s'\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s' (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) = Some cte
 2. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; cte_wp_at' (\<lambda>_. True) (ptr + word_of_nat n * 2 ^ cteSizeBits) s'\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; cte_wp_at' (\<lambda>_. True) (ptr + word_of_nat n * 2 ^ cteSizeBits) s'\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> \<exists>cref cte. ctes_of s' cref = Some cte \<and> cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> cte_refs' (cteCap cte) (irq_node' s') proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s' (cte_map slot) = Some cte \<and> cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) \<in> cte_refs' (cteCap cte) (irq_node' s') proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..<1 + word_of_nat n}. cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) = ptr + x * 2 ^ cteSizeBits proof (prove)
goal (2 subgoals):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n) = ptr + word_of_nat n * 2 ^ cteSizeBits
 2. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n \<in> {0..<1 + word_of_nat n} proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n \<in> {0..<1 + word_of_nat n} proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n < 1 + word_of_nat n proof (prove)
goal (2 subgoals):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n \<le> word_of_nat n
 2. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - cte_level_bits) < 2 ^ LENGTH(32)
 2. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < word_of_nat (2 ^ (word_bits - cte_level_bits))\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (3 subgoals):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> word_bits - cte_level_bits < LENGTH(32)
 2. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < word_of_nat (2 ^ (word_bits - cte_level_bits))\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea\<rbrakk> \<Longrightarrow> 1 < 2
 2. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < word_of_nat (2 ^ (word_bits - cte_level_bits))\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < word_of_nat (2 ^ (word_bits - cte_level_bits))\<rbrakk> \<Longrightarrow> word_of_nat n + 1 \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < 2 ^ (word_bits - cte_level_bits); word_of_nat n + 1 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s' cte ctea. \<lbrakk>ptr + 2 ^ cte_level_bits * word_of_nat n = cte_map (ptr, nat_to_cref (zombie_cte_bits bits) n); n < 2 ^ (word_bits - cte_level_bits); \<not> capRemovable (capability.Zombie ptr (zbits_map bits) (Suc n)) (cte_map slot); invs' s'; sch_act_simple s'; ctes_of s' (cte_map slot) = Some cte; cteCap cte = capability.Zombie ptr (zbits_map bits) (Suc n); valid_cap' (capability.Zombie ptr (zbits_map bits) (Suc n)) s'; ctes_of s' (ptr + word_of_nat n * 2 ^ cteSizeBits) = Some ctea; word_of_nat n < 2 ^ (word_bits - cte_level_bits); word_of_nat n + 1 - 1 = 0 - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>C\<in>rec_del_concrete (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True). spec_corres s_ (dc \<oplus> (case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of FinaliseSlotCall x xa \<Rightarrow> \<lambda>r r'. fst r = fst r' \<and> cap_relation (snd r) (snd r') | _ \<Rightarrow> dc)) (einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) and cte_wp_at (\<lambda>_. True) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and emptyable (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<forall>t\<in>obj_refs cap. halted_if_tcb t s | _ \<Rightarrow> True)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (slot_rdcall (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True))) s) and (\<lambda>s. case ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True of ReduceZombieCall cap sl ex \<Rightarrow> \<exists>cp'. cap_relation cap cp' \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cp') (cte_map sl) and (\<lambda>s. \<not> capRemovable cp' (cte_map sl) \<and> (\<not> ex \<longrightarrow> \<not> capCyclicZombie cp' (cte_map sl)))) s | _ \<Rightarrow> True)) (rec_del (ReduceZombieCall (cap.Zombie ptr bits (Suc n)) slot True)) C

goal:
No subgoals!