theory CSpace_C

lemma emptySlot_helper:
  fixes mdbNode
  defines "nextmdb \<equiv> Ptr &(Ptr ((mdbNext_CL (mdb_node_lift mdbNode)))::cte_C ptr\<rightarrow>[''cteMDBNode_C'']) :: mdb_node_C ptr"
  defines "nextcte \<equiv> Ptr ((mdbNext_CL (mdb_node_lift mdbNode)))::cte_C ptr"
  shows "\<lbrakk>cmdbnode_relation rva mdbNode\<rbrakk>
    \<Longrightarrow> ccorres dc xfdc \<top> UNIV hs
           (updateMDB (mdbNext rva)
             (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb)))
           (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
              Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t  nextcte\<rbrace>
               (CALL mdb_node_ptr_set_mdbPrev(nextmdb,
                ptr_val (Ptr (mdbPrev_CL (mdb_node_lift mdbNode)))))
            FI;;
            IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
              Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t  nextcte\<rbrace>
               (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged(h_val (hrs_mem \<acute>t_hrs)
               nextmdb));;
              \<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
              IF \<acute>ret__int \<noteq> 0 THEN
                SKIP
              ELSE
                \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged(mdbNode);;
                \<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
              FI;;
              Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t  nextcte\<rbrace>
               (CALL mdb_node_ptr_set_mdbFirstBadged(nextmdb,scast \<acute>ret__int))
            FI)" apply (rule ccorres_guard_imp2) apply (rule ccorres_updateMDB_cte_at) apply (subgoal_tac "mdbNext rva=(mdbNext_CL (mdb_node_lift mdbNode))") prefer 2 apply (simp add: cmdbnode_relation_def) apply (case_tac "mdbNext rva \<noteq> 0") apply (case_tac "mdbNext_CL (mdb_node_lift mdbNode) = 0", simp)

   \<comment> \<open>case where mdbNext rva \<noteq> 0 and mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<close> apply (unfold updateMDB_def) apply (clarsimp simp: Let_def) apply (rule ccorres_pre_getCTE [where P = "\<lambda>cte s. ctes_of s (mdbNext rva) = Some cte" and P' = "\<lambda>_. UNIV"]) apply (rule ccorres_from_vcg) apply (rule allI) apply (rule conseqPre, vcg) apply clarsimp apply (frule(1) rf_sr_ctes_of_clift) apply (clarsimp simp: typ_heap_simps' nextmdb_def nextcte_def) apply (intro conjI impI allI)

     \<comment> \<open>\<dots> \<exists>x\<in>fst \<dots>\<close> apply clarsimp apply (rule fst_setCTE [OF ctes_of_cte_at], assumption ) apply (erule bexI [rotated]) apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp add: rf_sr_def cstate_relation_def typ_heap_simps
                Let_def cpspace_relation_def) apply (rule conjI) prefer 2 apply (erule_tac t = s' in ssubst) apply (simp add: carch_state_relation_def cmachine_state_relation_def h_t_valid_clift_Some_iff
                       cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]
                       typ_heap_simps') apply (erule (1) setCTE_tcb_case) apply (erule (2)  cspace_cte_relation_upd_mdbI) apply (simp add: cmdbnode_relation_def) apply (simp add: mdb_node_to_H_def) apply (subgoal_tac "mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) =
                         mdbFirstBadged_CL (mdb_node_lift mdbNode)") prefer 2 subgoal by (simp add: mdb_node_lift_def mask_def word_bw_assocs) apply (subgoal_tac "mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) =
                         mdbFirstBadged_CL (cteMDBNode_CL y)") prefer 2 apply (drule cteMDBNode_CL_lift [symmetric]) subgoal by (simp add: mdb_node_lift_def word_bw_assocs) subgoal by (simp add: to_bool_def)
   \<comment> \<open>\<dots> \<exists>x\<in>fst \<dots>\<close> apply clarsimp apply (rule fst_setCTE [OF ctes_of_cte_at], assumption ) apply (erule bexI [rotated]) apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp add: rf_sr_def cstate_relation_def typ_heap_simps
              Let_def cpspace_relation_def) apply (rule conjI) prefer 2 apply (erule_tac t = s' in ssubst) apply (simp add: carch_state_relation_def cmachine_state_relation_def
                     h_t_valid_clift_Some_iff
                     cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]
                     typ_heap_simps') apply (erule (1) setCTE_tcb_case) apply (erule (2)  cspace_cte_relation_upd_mdbI) apply (simp add: cmdbnode_relation_def) apply (simp add: mdb_node_to_H_def) apply (subgoal_tac "mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) =
                       mdbFirstBadged_CL (mdb_node_lift mdbNode)") prefer 2 subgoal by (simp add: mdb_node_lift_def mask_def word_bw_assocs) apply (subgoal_tac "mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) =
                       mdbFirstBadged_CL (cteMDBNode_CL y)") prefer 2 apply (drule cteMDBNode_CL_lift [symmetric]) subgoal by (simp add: mdb_node_lift_def mask_def word_bw_assocs) apply (simp add: to_bool_def split: if_split)

  \<comment> \<open>trivial case where mdbNext rva = 0\<close> apply (simp add:ccorres_cond_empty_iff) apply (rule ccorres_guard_imp2) apply (rule ccorres_return_Skip) apply simp apply (clarsimp simp: cmdbnode_relation_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cmdbnode_relation rva mdbNode \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI) proof (prove)
goal (2 subgoals):
 1. cmdbnode_relation rva mdbNode \<Longrightarrow> ccorres dc xfdc ?Q ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. cmdbnode_relation rva mdbNode \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. cmdbnode_relation rva mdbNode \<Longrightarrow> mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. cmdbnode_relation rva mdbNode \<Longrightarrow> mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext rva \<noteq> 0; mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (updateMDB (mdbNext rva) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb))) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext rva \<noteq> 0; mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (do cte <- getCTE (mdbNext_CL (mdb_node_lift mdbNode));
setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,mdbPrev_CL (mdb_node_lift mdbNode)));;
Cond UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))) SKIP)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?G3 ?Q' hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> ?G3 s) \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<And>cte. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. ctes_of s (mdbNext rva) = Some cte) UNIV hs (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,mdbPrev_CL (mdb_node_lift mdbNode)));;
Cond UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))) SKIP)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ctes_of \<sigma> (mdbNext rva) = Some cte \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,mdbPrev_CL (mdb_node_lift mdbNode)));;
Cond UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))) SKIP {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma>. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. ctes_of \<sigma> (mdbNext rva) = Some cte \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,mdbPrev_CL (mdb_node_lift mdbNode)));;
Cond UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))) SKIP {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma>. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. ctes_of \<sigma> (mdbNext rva) = Some cte \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c nextcte \<and> s \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift s (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode) && ~~ mask 3\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift s (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> (\<forall>ta. ret__unsigned_' ta = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<longrightarrow> ((if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 then 1 else 0) && mask 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 then 1 else 0, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 then 1 else 0, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>))))) \<and> ((if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> (\<forall>ta. ret__unsigned_' ta = mdbFirstBadged_CL (mdb_node_lift mdbNode) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := SCAST(32 signed \<rightarrow> 32) (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0) && mask 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>))))))))}
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma> x. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c nextcte \<and> x \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> ((\<exists>ta. ret__unsigned_' ta = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb))) \<longrightarrow> (mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode)) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma> x. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte; (\<sigma>, x) \<in> rf_sr; \<exists>cte'. cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c nextcte \<and> x \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> ((\<exists>ta. ret__unsigned_' ta = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb))) \<longrightarrow> (mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) \<noteq> 0 \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) nextmdb)) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode)) \<longrightarrow> t \<Turnstile>\<^sub>c nextcte \<and> t \<Turnstile>\<^sub>c cparent nextmdb [''cteMDBNode_C''] \<and> (\<forall>ta. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))\<lparr>mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent nextmdb [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift t (cparent nextmdb [''cteMDBNode_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (cteMDBNode cte) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (cteMDBNode cte))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> (mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0 \<longrightarrow> (\<forall>t. (\<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (mdbFirstBadged_CL (cteMDBNode_CL y) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode)) \<longrightarrow> (\<forall>t. (\<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ((), s') \<in> fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (?cte141 \<sigma> x cte' y t mdb_node ta tb mdb_nodea) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> ?cte141 \<sigma> x cte' y t mdb_node ta tb mdb_nodea); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; \<exists>cte'. cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte_to_H y = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (cteMDBNode_CL y), ret__int_' := 1, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>))) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurThread \<sigma> = ksCurThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksIdleThread \<sigma> = ksIdleThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cinterrupt_relation (ksInterruptState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> gsUserPages \<sigma> = gsUserPages (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> gsCNodes \<sigma> = gsCNodes (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cdom_schedule_relation (kernel_state.ksDomSchedule (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurDomain \<sigma> = ksCurDomain (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksDomainTime \<sigma> = ksDomainTime (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmdbnode_relation (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) mdb_nodea
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = mdb_node_to_H (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged (mdb_node_to_H (mdb_node_lift mdbNode))) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged (mdb_node_to_H (mdb_node_lift mdbNode))) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y))) = mdbFirstBadged_update (\<lambda>_. True) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y)))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma>_ (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y_); cslift x_ (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'_; cte_lift cte'_ = Some y_; c_valid_cte cte'_; mdb_node_lift mdb_node_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_)); ret__unsigned_' ta_ = mdbFirstBadged_CL (cteMDBNode_CL y_); mdbFirstBadged_CL (cteMDBNode_CL y_) \<noteq> 0; mdb_node_lift mdb_nodea_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea_) cte'_)) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_))); s'_ = \<sigma>_\<lparr>ksPSpace := ksPSpace s'_\<rparr>; ctes_of s'_ = (ctes_of \<sigma>_)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y_)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y_))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y_)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); cteMDBNode_CL y = mdb_node_lift (cteMDBNode_C cte')\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 3. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 4. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 5. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma>_ (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y_); cslift x_ (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'_; c_valid_cte cte'_; mdb_node_lift mdb_node_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_)); ret__unsigned_' ta_ = mdbFirstBadged_CL (cteMDBNode_CL y_); mdbFirstBadged_CL (cteMDBNode_CL y_) \<noteq> 0; mdb_node_lift mdb_nodea_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea_) cte'_)) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_))); s'_ = \<sigma>_\<lparr>ksPSpace := ksPSpace s'_\<rparr>; ctes_of s'_ = (ctes_of \<sigma>_)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y_)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y_))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y_)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); cteMDBNode_CL y_ = mdb_node_lift (cteMDBNode_C cte'_)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y_) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y_) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) \<noteq> 0; mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))
 2. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma>_ (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y_); cslift x_ (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'_; cte_lift cte'_ = Some y_; c_valid_cte cte'_; mdb_node_lift mdb_node_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_)); ret__unsigned_' ta_ = mdbFirstBadged_CL (cteMDBNode_CL y_); mdbFirstBadged_CL (cteMDBNode_CL y_) \<noteq> 0; mdb_node_lift mdb_nodea_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea_) cte'_)) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_))); s'_ = \<sigma>_\<lparr>ksPSpace := ksPSpace s'_\<rparr>; ctes_of s'_ = (ctes_of \<sigma>_)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y_)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y_))) (to_bool (mdbFirstBadged_CL (cteMDBNode_CL y_)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y_) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y_)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (cteMDBNode_CL y_)) \<or> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = mdbFirstBadged_CL (cteMDBNode_CL y); mdbFirstBadged_CL (cteMDBNode_CL y) = 0; \<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift mdbNode); \<exists>mdb_nodea. mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ((), s') \<in> fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (?cte213 \<sigma> x cte' y t mdb_node ta tb tc mdb_nodea) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> ?cte213 \<sigma> x cte' y t mdb_node ta tb tc mdb_nodea); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (mdbNext_CL (mdb_node_lift mdbNode)) (cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; \<exists>cte'. cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte_to_H y = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := mdbFirstBadged_CL (mdb_node_lift mdbNode), ret__int_' := if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then 1 else 0, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>))) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurThread \<sigma> = ksCurThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksIdleThread \<sigma> = ksIdleThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cinterrupt_relation (ksInterruptState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> gsUserPages \<sigma> = gsUserPages (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> gsCNodes \<sigma> = gsCNodes (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cdom_schedule_relation (kernel_state.ksDomSchedule (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurDomain \<sigma> = ksCurDomain (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksDomainTime \<sigma> = ksDomainTime (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y))) ((cslift x)(cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode)) \<mapsto> cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) cte_Ptr ccte_relation
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmdbnode_relation (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) (mdb_node_to_H (cteMDBNode_CL y)))) mdb_nodea
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = mdb_node_to_H (mdb_node_lift mdbNode); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged (mdb_node_to_H (mdb_node_lift mdbNode))) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_update (\<lambda>_. mdbFirstBadged (mdb_node_to_H (cteMDBNode_CL y)) \<or> mdbFirstBadged (mdb_node_to_H (mdb_node_lift mdbNode))) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y))) = mdbFirstBadged_update (\<lambda>_. to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)) (mdbPrev_update (\<lambda>_. mdbPrev_CL (mdb_node_lift mdbNode)) (mdb_node_to_H (cteMDBNode_CL y)))
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma>_ (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y_); cslift x_ (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'_; cte_lift cte'_ = Some y_; c_valid_cte cte'_; mdb_node_lift mdb_node_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_)); ret__unsigned_' ta_ = 0; mdbFirstBadged_CL (cteMDBNode_CL y_) = 0; ret__unsigned_' tc_ = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea_) cte'_)) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_))); s'_ = \<sigma>_\<lparr>ksPSpace := ksPSpace s'_\<rparr>; ctes_of s'_ = (ctes_of \<sigma>_)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y_)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y_))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); cteMDBNode_CL y = mdb_node_lift (cteMDBNode_C cte')\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)
 2. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 3. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 4. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma>_ (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y_); cslift x_ (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'_; c_valid_cte cte'_; mdb_node_lift mdb_node_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_)); ret__unsigned_' ta_ = 0; mdbFirstBadged_CL (cteMDBNode_CL y_) = 0; ret__unsigned_' tc_ = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea_ = cteMDBNode_CL y_\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea_) cte'_)) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node_) cte'_)) (t_hrs_' (globals x_))); s'_ = \<sigma>_\<lparr>ksPSpace := ksPSpace s'_\<rparr>; ctes_of s'_ = (ctes_of \<sigma>_)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y_)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y_))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); cteMDBNode_CL y_ = mdb_node_lift (cteMDBNode_C cte'_)\<rbrakk> \<Longrightarrow> mdbFirstBadged_CL (cteMDBNode_CL y_) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y_) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y t mdb_node ta tb tc mdb_nodea s'. \<lbrakk>rva = MDB (mdbNext_CL (mdb_node_lift mdbNode)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (mdb_node_lift mdbNode))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode))); mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0; ctes_of \<sigma> (mdbNext_CL (mdb_node_lift mdbNode)) = Some (cte_to_H y); cslift x (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; mdb_node_lift mdb_node = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x)); ret__unsigned_' ta = 0; mdbFirstBadged_CL (cteMDBNode_CL y) = 0; ret__unsigned_' tc = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdb_node_lift mdb_nodea = cteMDBNode_CL y\<lparr>mdbPrev_CL := mdbPrev_CL (mdb_node_lift mdbNode), mdbFirstBadged_CL := (if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_nodea) cte')) (hrs_mem_update (heap_update (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) (cteMDBNode_C_update (\<lambda>_. mdb_node) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(mdbNext_CL (mdb_node_lift mdbNode) \<mapsto> cteMDBNode_update (\<lambda>_. MDB (mdbNext_CL (cteMDBNode_CL y)) (mdbPrev_CL (mdb_node_lift mdbNode)) (to_bool (mdbRevocable_CL (cteMDBNode_CL y))) (to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)))) (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; mdbFirstBadged_CL (mdb_node_lift mdbNode) && mask (Suc 0) = mdbFirstBadged_CL (mdb_node_lift mdbNode); mdbFirstBadged_CL (cteMDBNode_CL y) && mask (Suc 0) = mdbFirstBadged_CL (cteMDBNode_CL y)\<rbrakk> \<Longrightarrow> to_bool (mdbFirstBadged_CL (mdb_node_lift mdbNode)) = to_bool ((if mdbFirstBadged_CL (mdb_node_lift mdbNode) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) && 1)
 2. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = mdbNext_CL (mdb_node_lift mdbNode); \<not> mdbNext rva \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. \<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte) {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} hs (let slot = mdbNext rva in if slot = 0 then return () else do cte <- getCTE slot;
mdb <- return (cteMDBNode cte);
mdb' <- return (mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva) (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));
return (cteMDBNode_update (\<lambda>_. mdb') cte) >>= setCTE slot
od) (IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbPrev_'proc(nextmdb,ptr_val (PTR('a) (mdbPrev_CL (mdb_node_lift mdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift mdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) nextmdb));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c nextcte} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(nextmdb,SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI)
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = 0; mdbNext_CL (mdb_node_lift mdbNode) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. True) UNIV hs (return ()) SKIP
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = 0; mdbNext_CL (mdb_node_lift mdbNode) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc ?Q284 ?Q'284 hs (return ()) SKIP
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = 0; mdbNext_CL (mdb_node_lift mdbNode) = 0; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q284 s \<and> s' \<in> ?Q'284
 3. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; mdbNext rva = 0; mdbNext_CL (mdb_node_lift mdbNode) = 0; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV
 2. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>cmdbnode_relation rva mdbNode; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((mdbNext rva \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext rva) s) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext_CL (mdb_node_lift mdbNode)) = Some cte \<longrightarrow> ctes_of s (mdbNext rva) = Some cte)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext_CL (mdb_node_lift mdbNode))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal:
No subgoals!